CVE-2025-37780

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mac802154: check local interfaces before deleting sdata list

syzkaller reported a corrupted list in ieee802154_if_remove. [1]

Remove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4 hardware device from the system.

CPU0 CPU1 ==== ==== genl_family_rcv_msg_doit ieee802154_unregister_hw ieee802154_del_iface ieee802154_remove_interfaces rdev_del_virtual_intf_deprecated list_del(&sdata->list) ieee802154_if_remove list_del_rcu

The net device has been unregistered, since the rcu grace period, unregistration must be run before ieee802154_if_remove.

To avoid this issue, add a check for local->interfaces before deleting sdata list.

[1] kernel BUG at lib/list_debug.c:58! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 6277 Comm: syz-executor157 Not tainted 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__list_del_entry_valid_or_report+0xf4/0x140 lib/list_debug.c:56 Code: e8 a1 7e 00 07 90 0f 0b 48 c7 c7 e0 37 60 8c 4c 89 fe e8 8f 7e 00 07 90 0f 0b 48 c7 c7 40 38 60 8c 4c 89 fe e8 7d 7e 00 07 90 <0f> 0b 48 c7 c7 a0 38 60 8c 4c 89 fe e8 6b 7e 00 07 90 0f 0b 48 c7 RSP: 0018:ffffc9000490f3d0 EFLAGS: 00010246 RAX: 000000000000004e RBX: dead000000000122 RCX: d211eee56bb28d00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88805b278dd8 R08: ffffffff8174a12c R09: 1ffffffff2852f0d R10: dffffc0000000000 R11: fffffbfff2852f0e R12: dffffc0000000000 R13: dffffc0000000000 R14: dead000000000100 R15: ffff88805b278cc0 FS: 0000555572f94380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056262e4a3000 CR3: 0000000078496000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:124 [inline] __list_del_entry include/linux/list.h:215 [inline] list_del_rcu include/linux/rculist.h:157 [inline] ieee802154_if_remove+0x86/0x1e0 net/mac802154/iface.c:687 rdev_del_virtual_intf_deprecated net/ieee802154/rdev-ops.h:24 [inline] ieee802154_del_iface+0x2c0/0x5c0 net/ieee802154/nl-phy.c:323 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2551 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:744 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2607 ___sys_sendmsg net/socket.c:2661 [inline] __sys_sendmsg+0x292/0x380 net/socket.c:2690 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-57948)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop

Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug where KVM can load hardware with a stale vcpu->arch.dr6.

When the guest accesses a DR and host userspace isn't debugging the guest, KVM disables DR interception and loads the guest's values into hardware on VM-Enter and saves them on VM-Exit. This allows the guest to access DRs at will, e.g. so that a sequence of DR accesses to configure a breakpoint only generates one VM-Exit.

For DR0-DR3,…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mac802154: check local interfaces before deleting sdata list

syzkaller reported a corrupted list in ieee802154_if_remove. [1]

Remove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4 hardware device from the system.

CPU0 CPU1 ==== ==== genl_family_rcv_msg_doit ieee802154_unregister_hw ieee802154_del_iface ieee802154_remove_interfaces rdev_del_virtual_intf_deprecated list_del(&sdata->list) ieee802154_if_remove list_del_rcu

The net device has been unregistered, since the rcu grace period, unregistration must be run before ieee802154_if_remove.

To avoid this issue, add a check for local->interfaces before deleting sdata list.

[1] kernel BUG at lib/list_debug.c:58! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 6277 Comm: syz-executor157 Not tainted 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__list_del_entry_valid_or_report+0xf4/0x140 lib/list_debug.c:56 Code: e8 a1 7e 00 07 90 0f 0b 48 c7 c7 e0 37 60 8c 4c 89 fe e8 8f 7e 00 07 90 0f 0b 48 c7 c7 40 38 60 8c 4c 89 fe e8 7d 7e 00 07 90 <0f> 0b 48 c7 c7 a0 38 60 8c 4c 89 fe e8 6b 7e 00 07 90 0f 0b 48 c7 RSP: 0018:ffffc9000490f3d0 EFLAGS: 00010246 RAX: 000000000000004e RBX: dead000000000122 RCX: d211eee56bb28d00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88805b278dd8 R08: ffffffff8174a12c R09: 1ffffffff2852f0d R10: dffffc0000000000 R11: fffffbfff2852f0e R12: dffffc0000000000 R13: dffffc0000000000 R14: dead000000000100 R15: ffff88805b278cc0 FS: 0000555572f94380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056262e4a3000 CR3: 0000000078496000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:124 [inline] __list_del_entry include/linux/list.h:215 [inline] list_del_rcu include/linux/rculist.h:157 [inline] ieee802154_if_remove+0x86/0x1e0 net/mac802154/iface.c:687 rdev_del_virtual_intf_deprecated net/ieee802154/rdev-ops.h:24 [inline] ieee802154_del_iface+0x2c0/0x5c0 net/ieee802154/nl-phy.c:323 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2551 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:744 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2607 ___sys_sendmsg net/socket.c:2661 [inline] __sys_sendmsg+0x292/0x380 net/socket.c:2690 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-57948)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop

Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug where KVM can load hardware with a stale vcpu->arch.dr6.

When the guest accesses a DR and host userspace isn't debugging the guest, KVM disables DR interception and loads the guest's values into hardware on VM-Enter and saves them on VM-Exit. This allows the guest to access DRs at will, e.g. so that a sequence of DR accesses to configure a breakpoint only generates one VM-Exit.

For DR0-DR3,…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mac802154: check local interfaces before deleting sdata list

syzkaller reported a corrupted list in ieee802154_if_remove. [1]

Remove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4 hardware device from the system.

CPU0 CPU1 ==== ==== genl_family_rcv_msg_doit ieee802154_unregister_hw ieee802154_del_iface ieee802154_remove_interfaces rdev_del_virtual_intf_deprecated list_del(&sdata->list) ieee802154_if_remove list_del_rcu

The net device has been unregistered, since the rcu grace period, unregistration must be run before ieee802154_if_remove.

To avoid this issue, add a check for local->interfaces before deleting sdata list.

[1] kernel BUG at lib/list_debug.c:58! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 6277 Comm: syz-executor157 Not tainted 6.12.0-rc6-syzkaller-00005-g557329bcecc2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__list_del_entry_valid_or_report+0xf4/0x140 lib/list_debug.c:56 Code: e8 a1 7e 00 07 90 0f 0b 48 c7 c7 e0 37 60 8c 4c 89 fe e8 8f 7e 00 07 90 0f 0b 48 c7 c7 40 38 60 8c 4c 89 fe e8 7d 7e 00 07 90 <0f> 0b 48 c7 c7 a0 38 60 8c 4c 89 fe e8 6b 7e 00 07 90 0f 0b 48 c7 RSP: 0018:ffffc9000490f3d0 EFLAGS: 00010246 RAX: 000000000000004e RBX: dead000000000122 RCX: d211eee56bb28d00 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88805b278dd8 R08: ffffffff8174a12c R09: 1ffffffff2852f0d R10: dffffc0000000000 R11: fffffbfff2852f0e R12: dffffc0000000000 R13: dffffc0000000000 R14: dead000000000100 R15: ffff88805b278cc0 FS: 0000555572f94380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056262e4a3000 CR3: 0000000078496000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:124 [inline] __list_del_entry include/linux/list.h:215 [inline] list_del_rcu include/linux/rculist.h:157 [inline] ieee802154_if_remove+0x86/0x1e0 net/mac802154/iface.c:687 rdev_del_virtual_intf_deprecated net/ieee802154/rdev-ops.h:24 [inline] ieee802154_del_iface+0x2c0/0x5c0 net/ieee802154/nl-phy.c:323 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2551 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:744 ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2607 ___sys_sendmsg net/socket.c:2661 [inline] __sys_sendmsg+0x292/0x380 net/socket.c:2690 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-57948)

In the Linux kernel, the following vulnerability has been resolved:

KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop

Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug where KVM can load hardware with a stale vcpu->arch.dr6.

When the guest accesses a DR and host userspace isn't debugging the guest, KVM disables DR interception and loads the guest's values into hardware on VM-Enter and saves them on VM-Exit. This allows the guest to access DRs at will, e.g. so that a sequence of DR accesses to configure a breakpoint only generates one VM-Exit.

For DR0-DR3,…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx

blk_mq_run_hw_queues() could be run when there isn't queued request and after queue is cleaned up, at that time tagset is freed, because tagset lifetime is covered by driver, and often freed after blk_cleanup_queue() returns.

So don't touch ->tagset for figuring out current default hctx by the mapping built in request queue, so use-after-free on tagset can be avoided. Meantime this way should be fast than retrieving mapping from tagset.(CVE-2022-49377)

In the Linux kernel, the following vulnerability has been resolved:

macsec: fix UAF bug for real_dev

Create a new macsec device but not get reference to real_dev. That can not ensure that real_dev is freed after macsec. That will trigger the UAF bug for real_dev as following:

================================================================== BUG: KASAN: use-after-free in macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 Call Trace: ... macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 dev_get_iflink+0x73/0xe0 net/core/dev.c:637 default_operstate net/core/link_watch.c:42 [inline] rfc2863_policy+0x233/0x2d0 net/core/link_watch.c:54 linkwatch_do_dev+0x2a/0x150 net/core/link_watch.c:161

Allocated by task 22209: ... alloc_netdev_mqs+0x98/0x1100 net/core/dev.c:10549 rtnl_create_link+0x9d7/0xc00 net/core/rtnetlink.c:3235 veth_newlink+0x20e/0xa90 drivers/net/veth.c:1748

Freed by task 8: ... kfree+0xd6/0x4d0 mm/slub.c:4552 kvfree+0x42/0x50 mm/util.c:615 device_release+0x9f/0x240 drivers/base/core.c:2229 kobject_cleanup lib/kobject.c:673 [inline] kobject_release lib/kobject.c:704 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1c8/0x540 lib/kobject.c:721 netdev_run_todo+0x72e/0x10b0 net/core/dev.c:10327

After commit faab39f63c1f ("net: allow out-of-order netdev unregistration") and commit e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev"), we can add dev_hold_track() in macsec_dev_init() and dev_put_track() in macsec_free_netdev() to fix the problem.(CVE-2022-49390)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: don't skip expired elements during walk

There is an asymmetry between commit/abort and preparation phase if the following conditions are met:

1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled

In this case, following sequence is problematic:

1. element E in set S refers to chain C
2. userspace requests removal of set S
3. kernel does a set walk to decrement chain->use count for all elements from preparation phase
4. kernel does another set walk to remove elements from the commit phase (or another walk to do a chain->use increment for all elements from abort phase)

If E has already expired in 1), it will be ignored during list walk, so its use count won't have been changed.

Then, when set is culled, ->destroy callback will zap the element via nf_tables_set_elem_destroy(), but this function is only safe for elements that have been deactivated earlier from the preparation phase: lack of earlier deactivate removes the element but leaks the chain use count, which results in a WARN splat when the chain gets removed later, plus a leak of the nft_chain structure.

Update pipapo_get() not to skip expired elements, otherwise flush command reports bogus ENOENT errors.(CVE-2023-52924)

In the Linux kernel, the following vulnerability has been resolved:

powerpc/mm/fault: Fix kfence page fault reporting

copy_from_kernel_nofault() can be called when doing read of /proc/kcore. /proc/kcore can have some unmapped kfence objects which when read via copy_from_kernel_nofault() can cause page faults. Since *_nofault() functions define their own fixup table for handling fault, use that instead of…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx

blk_mq_run_hw_queues() could be run when there isn't queued request and after queue is cleaned up, at that time tagset is freed, because tagset lifetime is covered by driver, and often freed after blk_cleanup_queue() returns.

So don't touch ->tagset for figuring out current default hctx by the mapping built in request queue, so use-after-free on tagset can be avoided. Meantime this way should be fast than retrieving mapping from tagset.(CVE-2022-49377)

In the Linux kernel, the following vulnerability has been resolved:

macsec: fix UAF bug for real_dev

Create a new macsec device but not get reference to real_dev. That can not ensure that real_dev is freed after macsec. That will trigger the UAF bug for real_dev as following:

================================================================== BUG: KASAN: use-after-free in macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 Call Trace: ... macsec_get_iflink+0x5f/0x70 drivers/net/macsec.c:3662 dev_get_iflink+0x73/0xe0 net/core/dev.c:637 default_operstate net/core/link_watch.c:42 [inline] rfc2863_policy+0x233/0x2d0 net/core/link_watch.c:54 linkwatch_do_dev+0x2a/0x150 net/core/link_watch.c:161

Allocated by task 22209: ... alloc_netdev_mqs+0x98/0x1100 net/core/dev.c:10549 rtnl_create_link+0x9d7/0xc00 net/core/rtnetlink.c:3235 veth_newlink+0x20e/0xa90 drivers/net/veth.c:1748

Freed by task 8: ... kfree+0xd6/0x4d0 mm/slub.c:4552 kvfree+0x42/0x50 mm/util.c:615 device_release+0x9f/0x240 drivers/base/core.c:2229 kobject_cleanup lib/kobject.c:673 [inline] kobject_release lib/kobject.c:704 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1c8/0x540 lib/kobject.c:721 netdev_run_todo+0x72e/0x10b0 net/core/dev.c:10327

After commit faab39f63c1f ("net: allow out-of-order netdev unregistration") and commit e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev"), we can add dev_hold_track() in macsec_dev_init() and dev_put_track() in macsec_free_netdev() to fix the problem.(CVE-2022-49390)

In the Linux kernel, the following vulnerability has been resolved:

powerpc/mm/fault: Fix kfence page fault reporting

copy_from_kernel_nofault() can be called when doing read of /proc/kcore. /proc/kcore can have some unmapped kfence objects which when read via copy_from_kernel_nofault() can cause page faults. Since *_nofault() functions define their own fixup table for handling fault, use that instead of asking kfence to handle such faults.

Hence we search the exception tables for the nip which generated the fault. If there is an entry then we let the fixup table handler handle the page fault by returning an error from within ___do_page_fault().

This can be easily triggered if someone tries to do dd from /proc/kcore. eg. dd if=/proc/kcore of=/dev/null bs=1M

Some example false negatives:

=============================== BUG: KFENCE: invalid read in copy_from_kernel_nofault+0x9c/0x1a0 Invalid read at 0xc0000000fdff0000: copy_from_kernel_nofault+0x9c/0x1a0 0xc00000000665f950 read_kcore_iter+0x57c/0xa04 proc_reg_read_iter+0xe4/0x16c vfs_read+0x320/0x3ec ksys_read+0x90/0x154 system_call_exception+0x120/0x310 system_call_vectored_common+0x15c/0x2ec

BUG: KFENCE: use-after-free read in copy_from_kernel_nofault+0x9c/0x1a0 Use-after-free read at 0xc0000000fe050000 (in kfence-#2): copy_from_kernel_nofault+0x9c/0x1a0 0xc00000000665f950 read_kcore_iter+0x57c/0xa04 proc_reg_read_iter+0xe4/0x16c vfs_read+0x320/0x3ec ksys_read+0x90/0x154 system_call_exception+0x120/0x310 system_call_vectored_common+0x15c/0x2ec(CVE-2024-56678)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur

The action force…

Root has patched CVE-2025-37780 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-37780 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-37780 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: isofs: Prevent the use of too small fid syzbot reported a slab-out-of-bounds Read in isofs_fh_to_parent. [1] The handle_bytes value passed in by the reproducing program is equal to 12. In handle_to_path(), only 12 bytes of memory are allocated for the structure file_handle->f_handle member, which causes an out-of-bounds access when accessing the member parent_block of the structure isofs_fid in isofs, because accessing parent_block requires at least 16 bytes of f_handle. Here, fh_len is used to indirectly confirm that the value of handle_bytes is greater than 3 before accessing parent_block. [1] BUG: KASAN: slab-out-of-bounds in isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183 Read of size 4 at addr ffff0000cc030d94 by task syz-executor215/6466 CPU: 1 UID: 0 PID: 6466 Comm: syz-executor215 Not tainted 6.14.0-rc7-syzkaller-ga2392f333575 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0x198/0x550 mm/kasan/report.c:521 kasan_report+0xd8/0x138 mm/kasan/report.c:634 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380 isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183 exportfs_decode_fh_raw+0x2dc/0x608 fs/exportfs/expfs.c:523 do_handle_to_path+0xa0/0x198 fs/fhandle.c:257 handle_to_path fs/fhandle.c:385 [inline] do_handle_open+0x8cc/0xb8c fs/fhandle.c:403 __do_sys_open_by_handle_at fs/fhandle.c:443 [inline] __se_sys_open_by_handle_at fs/fhandle.c:434 [inline] __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 Allocated by task 6466: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:562 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4294 [inline] __kmalloc_noprof+0x32c/0x54c mm/slub.c:4306 kmalloc_noprof include/linux/slab.h:905 [inline] handle_to_path fs/fhandle.c:357 [inline] do_handle_open+0x5a4/0xb8c fs/fhandle.c:403 __do_sys_open_by_handle_at fs/fhandle.c:443 [inline] __se_sys_open_by_handle_at fs/fhandle.c:434 [inline] __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

• rds: tcp: block BH in TCP callbacks
• kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges
• module: correctly exit module_kallsyms_on_each_symbol when fn() != 0
• module: potential uninitialized return in module_kallsyms_on_each_symbol()
• module: use RCU to synchronize find_module
• kallsyms: refactor {,module_}kallsyms_on_each_symbol
• LTS tag: v5.4.295
• scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
• arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320}
• perf: Fix sample vs do_exit() {CVE-2025-38424}
• s390/pci: Fix __pcilg_mio_inuser() inline assembly
• rtc: test: Fix invalid format specifier.
• jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
• mm/huge_memory: fix dereferencing invalid pmd migration entry {CVE-2025-37958}
• rtc: Make rtc_time64_to_tm() support dates before 1970
• rtc: Improve performance of rtc_time64_to_tm(). Add tests.
• xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create {CVE-2022-48773}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
• ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
• ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• net: atm: add lec_mutex {CVE-2025-38323}
• calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
• tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
• tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
• atm: atmtcp: Free invalid length skb in atmtcp_c_send(). {CVE-2025-38185}
• mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
• wifi: carl9170: do not ping device which has failed to load firmware {CVE-2025-38420}
• aoe: clean device rq_list in aoedev_downdev() {CVE-2025-38326}
• hwmon: (occ) fix unaligned accesses
• drm/nouveau/bl: increase buffer size to avoid truncate warning
• erofs: remove unused trace event erofs_destroy_inode
• ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
• ALSA: hda/intel: Add Thinkpad E15 to PM deny list
• Input: sparcspkr - avoid unannotated fall-through
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
• selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
• scsi: s390: zfcp: Ensure synchronous unit_add
• scsi: storvsc: Increase the timeouts to storvsc_timeout
• jffs2: check jffs2_prealloc_raw_node_refs() result in few other places {CVE-2025-38328}
• jffs2: check that raw node were preallocated before writing summary {CVE-2025-38194}
• drivers/rapidio/rio_cm.c: prevent possible heap overwrite {CVE-2025-38090}
• powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
• platform/x86: dell_rbu: Stop overwriting data buffer
• platform: Add Surface platform directory
• Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
• tee: Prevent size calculation wraparound on 32-bit kernels
• ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
• bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
• watchdog: da9052_wdt: respect TWDMIN
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• sock: Correct error checking condition for (assign|release)_proto_idx()
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• vxlan: Do not treat dst cache initialization errors as fatal
• clk: rockchip: rk3036: mark ddrphy as critical
• wifi: mac80211: do not offer a mesh path if forwarding is disabled
• net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
• pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
• pinctrl: armada-37xx:…

• perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
• block: fix uaf for flush rq while iterating tags {CVE-2024-53170}
• zram: fix potential UAF of zram table {CVE-2025-21671}
• sched: sch_cake: add bounds checks to host bulk flow fairness counts {CVE-2025-21647}
• bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors {CVE-2024-56675}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
• ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702}
• RDMA/rxe: Fix incomplete state save in rxe_requester {CVE-2023-53539}
• crypto: xts - Handle EBUSY correctly {CVE-2023-53494}
• Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
• af_unix: Fix data-races around user->unix_inflight. {CVE-2023-53204}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367}
• wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}
• wifi: rtlwifi: remove unused dualmac control leftovers
• wifi: rtlwifi: remove unused timer and related code
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• ipmr: do not call mr_mfc_uses_dev() for unres entries {CVE-2025-21719}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
• net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
• null_blk: Always check queue mode setting from configfs {CVE-2023-53576}
• ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
• rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() {CVE-2023-53558}
• pstore/ram: Check start of empty przs during init {CVE-2023-53331}
• wifi: ath11k: fix memory leak in WMI firmware stats {CVE-2023-53602}
• wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
• net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() {CVE-2022-50486}
• RDMA/core: Make sure "ib_port" is valid when access sysfs node {CVE-2022-50475}
• RDMA/rxe: Fix mr->map double free {CVE-2022-50543}
• scsi: qla2xxx: Fix end of loop test
• scsi: qla2xxx: Fix mem access after free
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• scsi: target: Fix multiple LUN_RESET handling {CVE-2023-53586}
• scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
• scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses {CVE-2023-53675}
• scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() {CVE-2023-53675}
• scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841}
• nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
• efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
• bnxt: avoid overflow in bnxt_get_nvram_directory() {CVE-2023-53661}

• scsi: target: iscsi: Fix timeout on deleted connection {CVE-2025-38075}
• tls: wait for pending async decryptions if tls_strp_msg_hold fails {CVE-2025-40176}
• clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns {CVE-2025-38499}
• rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
• page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129}
• rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access {CVE-2025-38704}
• bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors {CVE-2024-56675}
• padata: Fix pd UAF once and for all {CVE-2025-38584}
• padata: do not leak refcount in reorder_work {CVE-2025-38031}
• Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
• Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• Bluetooth: MGMT: Remove unused mgmt_pending_find_data
• Bluetooth: MGMT: set_mesh: update LE scan interval and window
• Bluetooth: hci_sync: fix set_local_name race condition {CVE-2025-39797}
• xfrm: Duplicate SPI Handling {CVE-2025-39797}
• kernfs: Fix UAF in polling when open file is released {CVE-2025-39881}
• OPP: add index check to assert to avoid buffer overflow in _read_freq() {CVE-2024-57998}
• block: fix uaf for flush rq while iterating tags {CVE-2024-58072} {CVE-2024-53170}
• wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() {CVE-2025-21631}
• net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-40954}
• Squashfs: sanity check symbolic link size {CVE-2024-46744}
• e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898}
• wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• i40e: fix idx validation in config queues msg {CVE-2025-39971}
• NFS: Fix a race when updating an existing write {CVE-2025-39697}
• tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
• wifi: mt76: fix linked list corruption {CVE-2025-39918}
• io_uring/waitid: always prune wait queue entry in io_waitid_wait() {CVE-2025-40047}
• Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync {CVE-2025-39982}
• workqueue: Put the pwq after detaching the rescuer from the pool {CVE-2025-21786}
• zram: fix potential UAF of zram table {CVE-2025-21671}
• sched: sch_cake: add bounds checks to host bulk flow fairness counts {CVE-2025-21647}
• wifi: mt76: mt7925: fix off by one in mt7925_load_clc() {CVE-2024-57990}
• blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
• NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() {CVE-2024-54456}
• nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
• igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
• x86/tdx: Fix "in-kernel MMIO" check {CVE-2024-47727}
• drm/amd/display: Check dce_hwseq before dereferencing it {CVE-2025-38361}
• dm-bufio: don't schedule in atomic context {CVE-2025-37928}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• KVM: arm64: Tear down vGIC on failed vCPU creation {CVE-2025-37849}
• usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
• drm/amd/display: Fix out-of-bound accesses {CVE-2025-21985}
• usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
• pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• ipmr: do not call mr_mfc_uses_dev() for unres entries {CVE-2025-21719}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
• iommu/amd: Fix…

• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• spec: merge oraclelinux6els changes
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• mtd: inftlcore: Add error check for inftl_read_oob() {CVE-2025-37892}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}

• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
• wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
• scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
• fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
• atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
• atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• spec: merge oraclelinux6els changes
• ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
• ipvs: use explicitly signed chars
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
• xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
• netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• mtd: inftlcore: Add error check for inftl_read_oob() {CVE-2025-37892}
• igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• md-raid10: fix KASAN warning {CVE-2022-50211}
• usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
• ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
• crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}

• net/ieee802154: don't warn zero-sized raw_sendmsg() {CVE-2022-50706}
• bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
• media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
• pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
• wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue {CVE-2022-50164}
• mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• xfrm: Duplicate SPI Handling {CVE-2025-39797}
• scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input {CVE-2022-50030}
• net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent {CVE-2022-48883}
• net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
• dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() {CVE-2022-50050}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• nfs: fix UAF in direct writes {CVE-2024-26958}
• iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
• drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• i40e: fix idx validation in config queues msg {CVE-2025-39971}
• loop: Fix use-after-free issues {CVE-2023-53111}
• fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• iommu/amd: Fix potential buffer overflow in…

• net/ieee802154: don't warn zero-sized raw_sendmsg() {CVE-2022-50706}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
• wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• xfrm: Duplicate SPI Handling {CVE-2025-39797}
• scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input {CVE-2022-50030}
• net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent {CVE-2022-48883}
• net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
• dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
• ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() {CVE-2022-50050}
• nfs: fix UAF in direct writes {CVE-2024-26958}
• iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
• scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
• drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
• net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
• loop: Fix use-after-free issues {CVE-2023-53111}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
• wifi: mac80211: Fix UAF in ieee80211_scan_rx() {CVE-2022-49934}
• drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
• ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
• wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279}
• nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
• r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
• sctp: handle the error returned from sctp_auth_asoc_init_active_key {CVE-2022-50243}
• crypto: qat - resolve race condition during AER recovery {CVE-2024-39493}
• i40e: fix idx validation in config queues msg {CVE-2025-39971}
• netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
• platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
• netfilter: validate user input for expected length {CVE-2024-35962}
• wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
• Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
• wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• wifi: cfg80211: check A-MSDU format more carefully…

• smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
• netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
• ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. {CVE-2025-39913}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
• mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
• net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
• net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• media: dvb-frontends: avoid stack overflow warnings with clang {CVE-2024-27075}
• ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
• HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
• cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
• NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
• pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
• ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
• fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
• fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

• i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• media: rc: fix races with imon_disconnect() {CVE-2025-39993}
• VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
• tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
• drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
• Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
• net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410}
• i40e: add validation for ring_len param {CVE-2025-39973}
• vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
• sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
• nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
• isofs: Prevent the use of too small fid {CVE-2025-37780}
• net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
• Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
• i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
• ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}

In the Linux kernel, the following vulnerability has been resolved:

isofs: Prevent the use of too small fid

syzbot reported a slab-out-of-bounds Read in isofs_fh_to_parent. [1]

The handle_bytes value passed in by the reproducing program is equal to 12. In handle_to_path(), only 12 bytes of memory are allocated for the structure file_handle->f_handle member, which causes an out-of-bounds access when accessing the member parent_block of the structure isofs_fid in isofs, because accessing parent_block requires at least 16 bytes of f_handle. Here, fh_len is used to indirectly confirm that the value of handle_bytes is greater than 3 before accessing parent_block.

[1] BUG: KASAN: slab-out-of-bounds in isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183 Read of size 4 at addr ffff0000cc030d94 by task syz-executor215/6466 CPU: 1 UID: 0 PID: 6466 Comm: syz-executor215 Not tainted 6.14.0-rc7-syzkaller-ga2392f333575 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0x198/0x550 mm/kasan/report.c:521 kasan_report+0xd8/0x138 mm/kasan/report.c:634 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380 isofs_fh_to_parent+0x1b8/0x210 fs/isofs/export.c:183 exportfs_decode_fh_raw+0x2dc/0x608 fs/exportfs/expfs.c:523 do_handle_to_path+0xa0/0x198 fs/fhandle.c:257 handle_to_path fs/fhandle.c:385 [inline] do_handle_open+0x8cc/0xb8c fs/fhandle.c:403 __do_sys_open_by_handle_at fs/fhandle.c:443 [inline] __se_sys_open_by_handle_at fs/fhandle.c:434 [inline] __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

Allocated by task 6466: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:68 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:562 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4294 [inline] __kmalloc_noprof+0x32c/0x54c mm/slub.c:4306 kmalloc_noprof include/linux/slab.h:905 [inline] handle_to_path fs/fhandle.c:357 [inline] do_handle_open+0x5a4/0xb8c fs/fhandle.c:403 __do_sys_open_by_handle_at fs/fhandle.c:443 [inline] __se_sys_open_by_handle_at fs/fhandle.c:434 [inline] __arm64_sys_open_by_handle_at+0x80/0x94 fs/fhandle.c:434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:744 el0t_64_sync_handler+0x84/0x108 arch/arm64/kernel/entry-common.c:762 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-43869: perf: Fix hang while freeing sigtrap event (bsc#1229491).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
• CVE-2024-50029: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (bsc#1231949).
• CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-50294: rxrpc: Fix missing locking causing hanging calls (bsc#1233483).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53176: smb: During unmount, ensure all cached dir instances drop their dentry (bsc#1234894).
• CVE-2024-53177: smb: prevent use-after-free due to open_cached_dir error paths (bsc#1234896).
• CVE-2024-53178: smb: Do not leak cfid when reconnect races with open_cached_dir (bsc#1234895).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086). -…

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50162: bpf: selftests: send packet to devmap redirect XDP (bsc#1233075).
• CVE-2024-50163: bpf: Make sure internal and UAPI bpf_redirect flags do not overlap (bsc#1233098).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510).
• CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21696: mm: clear uffd-wp PTE/PMD state on mremap() (bsc#1237111).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21729: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (bsc#1237874).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1237882).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21806: net: let net.core.dev_weight always be non-zero (bsc#1238746).
• CVE-2025-21808: net: xdp: Disallow attaching device-bound programs in generic mode (bsc#1238742).
• CVE-2025-21812: ax25: rcu protect dev->ax25_ptr (bsc#1238471).
• CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
• CVE-2025-21833: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE (bsc#1239108).
• CVE-2025-21836: io_uring/kbuf: reallocate buf lists on upgrade (bsc#1239066).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21863: io_uring: prevent opcode speculation (bsc#1239475).
• CVE-2025-21867: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (bsc#1240181).
• CVE-2025-21873: scsi: ufs: core: bsg: Fix crash when arpmb command fails (bsc#1240184).
• CVE-2025-21875: mptcp: always handle address removal under msk socket lock (bsc#1240168).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21884: net: better track kernel sockets lifetime (bsc#1240171).
• CVE-2025-21887: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (bsc#1240176).
• CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx() (bsc#1240167).
• CVE-2025-21894: net: enetc: VFs do not…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
• CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
• CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
• CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
• CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
• CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
• CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
• CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
• CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (bsc#1242763).
• CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
• CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (bsc#1242507).
• CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
• CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
• CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
• CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
• CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
• CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
• CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (bsc#1242585).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
• CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
• CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
• CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
• CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
• CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
• CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
• CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
• CVE-2025-37842: spi: fsl-qspi: Fix double cleanup in probe error path (bsc#1242951).
• CVE-2025-37870: drm/amd/display: prevent hang on link training fail…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-35910: tcp: properly terminate timers for kernel sockets (bsc#1224489).
• CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-46782: ila: call nf_unregister_net_hooks() sooner (bsc#1230769).
• CVE-2024-47408: net/smc: check smcd_v2_ext_offset when receiving proposal msg (bsc#1235711).
• CVE-2024-47794: kABI: bpf: Prevent tailcall infinite loop caused by freplace kABI workaround (bsc#1235712).
• CVE-2024-49570: drm/xe/tracing: Fix a potential TP_printk UAF (bsc#1238782).
• CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (bsc#1235733).
• CVE-2024-50038: netfilter: xtables: fix typo causing some targets not to load on IPv6 (bsc#1231910).
• CVE-2024-50056: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c (bsc#1232389).
• CVE-2024-50140: net: sched: use RCU read-side critical section in taprio_dump() (bsc#1233060).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
• CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available() (bsc#1234157).
• CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
• CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-54683: netfilter: IDLETIMER: Fix for possible ABBA deadlock (bsc#1235729).
• CVE-2024-56638: kABI fix for 'netfilter: nft_inner: incorrect percpu area handling under softirq' (bsc#1235524).
• CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
• CVE-2024-56703: ipv6: Fix soft lockups in fib6_select_path under high next hop churn (bsc#1235455).
• CVE-2024-56718: net/smc: protect link down work from execute after lgr freed (bsc#1235589).
• CVE-2024-56719: net: stmmac: fix TSO DMA API usage causing oops (bsc#1235591).
• CVE-2024-56751: ipv6: release nexthop on device removal (bsc#1234936).
• CVE-2024-56758: btrfs: check folio mapping after unlock in relocate_one_folio() (bsc#1235621).
• CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
• CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
• CVE-2024-57924: fs: relax assertions on failure to encode file handles (bsc#1236086).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2024-57974: udp: Deal with race between UDP socket address change and rehash (bsc#1238532).
• CVE-2024-58018: nvkm: correctly calculate the available space of the GSP cmdq buffer (bsc#1238990).
• CVE-2024-58019: nvkm/gsp: correctly advance the read pointer of GSP message queue (bsc#1238997).
• CVE-2024-58068: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (bsc#1238961).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970).
• CVE-2024-58074: drm/i915: Grab intel_display from the encoder to avoid potential (bsc#1238972).
• CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
• CVE-2024-58088: bpf: Fix deadlock when freeing cgroup storage (bsc#1239510). -…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-35840: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() (bsc#1224597).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2024-58070: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT (bsc#1238983).
• CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
• CVE-2025-21683: bpf: Fix bpf_sk_select_reuseport() memory leak (bsc#1236704).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21707: mptcp: consolidate suboption status (bsc#1238862).
• CVE-2025-21758: ipv6: mcast: add RCU protection to mld_newpack() (bsc#1238737).
• CVE-2025-21768: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (bsc#1238714).
• CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
• CVE-2025-21792: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt (bsc#1238745).
• CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
• CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
• CVE-2025-21962: cifs: Fix integer overflow while processing closetimeo mount option (bsc#1240655).
• CVE-2025-21963: cifs: Fix integer overflow while processing acdirmax mount option (bsc#1240717).
• CVE-2025-21964: cifs: Fix integer overflow while processing acregmax mount option (bsc#1240740).
• CVE-2025-22018: atm: Fix NULL pointer dereference (bsc#1241266).
• CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
• CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
• CVE-2025-22058: udp: Fix memory accounting leak (bsc#1241332).
• CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
• CVE-2025-22064: netfilter: nf_tables: do not unregister hook when table is dormant (bsc#1241413).
• CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
• CVE-2025-22094: powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' (bsc#1241512).
• CVE-2025-22102: Bluetooth: btnxpuart: Fix kernel panic during FW release (bsc#1241456).
• CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
• CVE-2025-22104: ibmvnic: Use kernel helpers for hex dumps (bsc#1241550).
• CVE-2025-22107: net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() (bsc#1241575).
• CVE-2025-22109: ax25: Remove broken autobind (bsc#1241573).
• CVE-2025-23138: watch_queue: fix pipe accounting mismatch (bsc#1241648).
• CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (bsc#1242763).
• CVE-2025-23145: mptcp: fix NULL pointer in can_accept_new_subflow (bsc#1242596).
• CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
• CVE-2025-23154: io_uring/net: fix io_req_post_cqe abuse by send bundle (bsc#1242533).
• CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (bsc#1242507).
• CVE-2025-37747: kABI workaround for perf-Fix-hang-while-freeing-sigtrap-event (References: bsc#1242520).
• CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
• CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47670: can: peak_usb: fix use after free bugs (bsc#1241407).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49145: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (bsc#1238162).
• CVE-2022-49168: btrfs: do not clean up repair bio if submit fails (bsc#1238109).
• CVE-2022-49190: kernel/resource: fix kfree() of bootmem memory again (bsc#1238130).
• CVE-2022-49212: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init (bsc#1238331).
• CVE-2022-49216: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (bsc#1238338).
• CVE-2022-49235: ath9k_htc: fix uninit value bugs (bsc#1238333).
• CVE-2022-49248: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (bsc#1238284).
• CVE-2022-49253: media: usb: go7007: s2250-board: fix leak in probe() (bsc#1238420).
• CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (bsc#1238394).
• CVE-2022-49326: rtl818x: Prevent using not initialized queues (bsc#1238646).
• CVE-2022-49371: driver core: fix deadlock in __device_attach (bsc#1238546).
• CVE-2022-49382: soc: rockchip: Fix refcount leak in rockchip_grf_init (bsc#1238306).
• CVE-2022-49396: phy: qcom-qmp: fix reset-controller leak on probe errors (bsc#1238289).
• CVE-2022-49420: net: annotate races around sk->sk_bound_dev_if (bsc#1238887).
• CVE-2022-49441: tty: fix deadlock caused by calling printk() under tty_port->lock (bsc#1238263).
• CVE-2022-49445: pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() (bsc#1238019).
• CVE-2022-49460: PM / devfreq: rk3399_dmc: Disable edev on remove() (bsc#1238892).
• CVE-2022-49467: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() (bsc#1238815).
• CVE-2022-49474: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (bsc#1238071).
• CVE-2022-49491: drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (bsc#1238539).
• CVE-2022-49503: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (bsc#1238868).
• CVE-2022-49592: net: stmmac: fix dma queue left shift overflow issue (bsc#1238311).
• CVE-2022-49625: sfc: fix kernel panic when creating VF (bsc#1238411).
• CVE-2022-49635: drm/i915/selftests: fix subtraction overflow bug (bsc#1238806).
• CVE-2022-49652: dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (bsc#1238871).
• CVE-2022-49715: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (bsc#1238818).
• CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
• CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (bsc#1239060).
• CVE-2022-49751: w1: fix WARNING after calling w1_process() (bsc#1240254).
• CVE-2022-49761: btrfs: always report error in run_one_delayed_ref() (bsc#1240261).
• CVE-2022-49772: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (bsc#1242147).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49776: macvlan: enforce a consistent minimal mtu (bsc#1242248).
• CVE-2022-49787: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (bsc#1242352).
• CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (bsc#1242353).
• CVE-2022-49813: net: ena: Fix error handling in ena_init() (bsc#1242497).
• CVE-2022-49821: mISDN: fix possible memory leak in mISDN_dsp_element_register() (bsc#1242542).
• CVE-2022-49826: ata: libata-transport: fix double ata_host_put() in ata_tport_add() (bsc#1242549).
• CVE-2022-49829: drm/scheduler: fix fence ref counting (bsc#1242691).
• CVE-2022-49832: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (bsc#1242154).
• CVE-2022-49835: ALSA: hda: fix potential memleak in…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-28956: x86/ibt: Keep IBT disabled during alternative patching (bsc#1242006).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
• CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
• CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
• CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
• CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
• CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
• CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
• CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
• CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (bsc#1242763).
• CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
• CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (bsc#1242507).
• CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
• CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
• CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
• CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
• CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
• CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
• CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (bsc#1242585).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
• CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
• CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
• CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
• CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
• CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
• CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
• CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (bsc#1242868).
• CVE-2025-37842: spi: fsl-qspi: Fix double cleanup in probe error path (bsc#1242951).
• CVE-2025-37870: drm/amd/display: prevent hang on link training fail…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52888: media: mediatek: vcodec: Only free buffer VA that is not NULL (bsc#1228557).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
• CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
• CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
• CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
• CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
• CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
• CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
• CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
• CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (bsc#1242763).
• CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
• CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (bsc#1242507).
• CVE-2025-37743: wifi: ath12k: Avoid memory leak while enabling statistics (bsc#1242163).
• CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
• CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
• CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
• CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
• CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
• CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
• CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (bsc#1242585).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
• CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
• CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
• CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
• CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
• CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
• CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
• CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
• CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52888: media: mediatek: vcodec: Only free buffer VA that is not NULL (bsc#1228557).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-49568: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg (bsc#1235728).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
• CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
• CVE-2025-21868: kABI workaround for adding an header (bsc#1240180).
• CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
• CVE-2025-21938: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr (bsc#1240723).
• CVE-2025-21997: xsk: fix an integer overflow in xp_create_and_assign_umem() (bsc#1240823).
• CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
• CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
• CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
• CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
• CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
• CVE-2025-22113: ext4: define ext4_journal_destroy wrapper (bsc#1241617).
• CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (bsc#1242763).
• CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (bsc#1242507).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37743: wifi: ath12k: Avoid memory leak while enabling statistics (bsc#1242163).
• CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
• CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
• CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
• CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
• CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
• CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
• CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (bsc#1242585).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
• CVE-2025-37801: spi: spi-imx: Add check for spi_imx_setupxfer() (bsc#1242850).
• CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
• CVE-2025-37804: io_uring: always do…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52888: media: mediatek: vcodec: Only free buffer VA that is not NULL (bsc#1228557).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
• CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
• CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
• CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
• CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
• CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
• CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
• CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
• CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (bsc#1242763).
• CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
• CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (bsc#1242507).
• CVE-2025-37743: wifi: ath12k: Avoid memory leak while enabling statistics (bsc#1242163).
• CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
• CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
• CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
• CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
• CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
• CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
• CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (bsc#1242585).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
• CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
• CVE-2025-37804: io_uring: always do atomic put from iowq (bsc#1242854).
• CVE-2025-37809: usb: typec: class: Unlocked on error in typec_register_partner() (bsc#1242856).
• CVE-2025-37820: xen-netfront: handle NULL returned by xdp_convert_buff_to_frame() (bsc#1242866).
• CVE-2025-37823: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (bsc#1242924).
• CVE-2025-37824: tipc: fix NULL pointer dereference in tipc_mon_reinit_self() (bsc#1242867).
• CVE-2025-37829: cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() (bsc#1242875).
• CVE-2025-37830: cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() (bsc#1242860).
• CVE-2025-37831: cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate() (bsc#1242861).
• CVE-2025-37833: net/niu: Niu requires MSIX ENTRY_DATA…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-52888: media: mediatek: vcodec: Only free buffer VA that is not NULL (bsc#1228557).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-49568: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg (bsc#1235728).
• CVE-2024-50223: sched/numa: Fix the potential null pointer dereference in (bsc#1233192).
• CVE-2024-53135: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (bsc#1234154).
• CVE-2024-54458: scsi: ufs: bsg: Set bsg_queue to NULL after removal (bsc#1238992).
• CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (bsc#1236142).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1237312).
• CVE-2025-21787: team: better TEAM_OPTION_TYPE_STRING validation (bsc#1238774).
• CVE-2025-21814: ptp: Ensure info->enable callback is always set (bsc#1238473).
• CVE-2025-21868: kABI workaround for adding an header (bsc#1240180).
• CVE-2025-21919: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (bsc#1240593).
• CVE-2025-21938: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr (bsc#1240723).
• CVE-2025-21997: xsk: fix an integer overflow in xp_create_and_assign_umem() (bsc#1240823).
• CVE-2025-22021: netfilter: socket: Lookup orig tuple for IPv6 SNAT (bsc#1241282).
• CVE-2025-22030: mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() (bsc#1241376).
• CVE-2025-22056: netfilter: nft_tunnel: fix geneve_opt type confusion addition (bsc#1241525).
• CVE-2025-22057: net: decrease cached dst counters in dst_release (bsc#1241533).
• CVE-2025-22063: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (bsc#1241351).
• CVE-2025-22070: fs/9p: fix NULL pointer dereference on mkdir (bsc#1241305).
• CVE-2025-22103: net: fix NULL pointer dereference in l3mdev_l3_rcv (bsc#1241448).
• CVE-2025-22113: ext4: define ext4_journal_destroy wrapper (bsc#1241617).
• CVE-2025-23140: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error (bsc#1242763).
• CVE-2025-23150: ext4: fix off-by-one error in do_split (bsc#1242513).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-23160: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization (bsc#1242507).
• CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846).
• CVE-2025-37743: wifi: ath12k: Avoid memory leak while enabling statistics (bsc#1242163).
• CVE-2025-37748: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group (bsc#1242523).
• CVE-2025-37749: net: ppp: Add bound checking for skb data on ppp_sync_txmung (bsc#1242859).
• CVE-2025-37750: smb: client: fix UAF in decryption with multichannel (bsc#1242510).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1242504).
• CVE-2025-37755: net: libwx: handle page_pool_dev_alloc_pages error (bsc#1242506).
• CVE-2025-37773: virtiofs: add filesystem context source name check (bsc#1242502).
• CVE-2025-37780: isofs: Prevent the use of too small fid (bsc#1242786).
• CVE-2025-37787: net: dsa: mv88e6xxx: avoid unregistering devlink regions which were never registered (bsc#1242585).
• CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action (bsc#1242762).
• CVE-2025-37790: net: mctp: Set SOCK_RCU_FREE (bsc#1242509).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
• CVE-2025-37801: spi: spi-imx: Add check for spi_imx_setupxfer() (bsc#1242850).
• CVE-2025-37803: udmabuf: fix a buf size overflow issue during udmabuf creation (bsc#1242852).
• CVE-2025-37804: io_uring: always do…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• TPM device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Synopsys DesignWare PCIe PMU;
• Mellanox platform drivers;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• SPI subsystem;
• GPIB drivers;
• VideoCore services drivers;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB Type-C support driver;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• 9P distributed file system;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file systems library;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• Overlay file system;
• SMB network file system;
• Ethernet bridge;
• io_uring subsystem;
• Perf events;
• Memory management;
• UProbes tracing;
• Amateur Radio drivers;
• SCTP protocol;
• Network sockets;
• RDMA verbs API;
• BPF subsystem;
• Kernel fork() syscall;
• Hibernation control;
• Scheduler infrastructure;
• Tracing infrastructure;
• Watch queue notification mechanism;
• Vector I/O iterator library;
• 802.1Q VLAN protocol;
• 9P file system network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Networking core;
• Distributed Switch Architecture;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Wireless networking;
• ALSA framework;
• WCD audio codecs;
• SoC Audio for Freescale CPUs drivers;
• SoC Audio generic drivers;
• Intel ASoC drivers;
• QCOM ASoC drivers;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-37806, CVE-2025-22084, CVE-2025-39688, CVE-2025-22030, CVE-2025-37754, CVE-2025-37783, CVE-2025-37825, CVE-2025-37752, CVE-2025-22104, CVE-2025-40014, CVE-2025-22103, CVE-2025-37874, CVE-2025-37773, CVE-2025-37741, CVE-2025-37763, CVE-2025-37859, CVE-2025-37779, CVE-2025-23155, CVE-2025-23143, CVE-2025-37788, CVE-2025-22028, CVE-2024-58096, CVE-2025-37842, CVE-2025-37854, CVE-2025-38637, CVE-2024-58097, CVE-2023-53034, CVE-2025-37797, CVE-2025-37851, CVE-2025-37941, CVE-2025-37942, CVE-2025-37748, CVE-2025-37982, CVE-2025-22058, CVE-2025-37781, CVE-2025-23130, CVE-2025-23149, CVE-2025-23146, CVE-2025-37809, CVE-2025-37801, CVE-2025-22080,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• TPM device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Synopsys DesignWare PCIe PMU;
• Mellanox platform drivers;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• SPI subsystem;
• GPIB drivers;
• VideoCore services drivers;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB Type-C support driver;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• 9P distributed file system;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file systems library;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• Overlay file system;
• SMB network file system;
• Ethernet bridge;
• io_uring subsystem;
• Perf events;
• Memory management;
• UProbes tracing;
• Amateur Radio drivers;
• SCTP protocol;
• Network sockets;
• RDMA verbs API;
• BPF subsystem;
• Kernel fork() syscall;
• Hibernation control;
• Scheduler infrastructure;
• Tracing infrastructure;
• Watch queue notification mechanism;
• Vector I/O iterator library;
• 802.1Q VLAN protocol;
• 9P file system network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Networking core;
• Distributed Switch Architecture;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Wireless networking;
• ALSA framework;
• WCD audio codecs;
• SoC Audio for Freescale CPUs drivers;
• SoC Audio generic drivers;
• Intel ASoC drivers;
• QCOM ASoC drivers;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-37806, CVE-2025-22084, CVE-2025-39688, CVE-2025-22030, CVE-2025-37754, CVE-2025-37783, CVE-2025-37825, CVE-2025-37752, CVE-2025-22104, CVE-2025-40014, CVE-2025-22103, CVE-2025-37874, CVE-2025-37773, CVE-2025-37741, CVE-2025-37763, CVE-2025-37859, CVE-2025-37779, CVE-2025-23155, CVE-2025-23143, CVE-2025-37788, CVE-2025-22028, CVE-2024-58096, CVE-2025-37842, CVE-2025-37854, CVE-2025-38637, CVE-2024-58097, CVE-2023-53034, CVE-2025-37797, CVE-2025-37851, CVE-2025-37941, CVE-2025-37942, CVE-2025-37748, CVE-2025-37982, CVE-2025-22058, CVE-2025-37781, CVE-2025-23130, CVE-2025-23149, CVE-2025-23146, CVE-2025-37809, CVE-2025-37801, CVE-2025-22080,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• TPM device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Synopsys DesignWare PCIe PMU;
• Mellanox platform drivers;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• SPI subsystem;
• GPIB drivers;
• VideoCore services drivers;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB Type-C support driver;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• 9P distributed file system;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file systems library;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• Overlay file system;
• SMB network file system;
• Ethernet bridge;
• io_uring subsystem;
• Perf events;
• Memory management;
• UProbes tracing;
• Amateur Radio drivers;
• SCTP protocol;
• Network sockets;
• RDMA verbs API;
• BPF subsystem;
• Kernel fork() syscall;
• Hibernation control;
• Scheduler infrastructure;
• Tracing infrastructure;
• Watch queue notification mechanism;
• Vector I/O iterator library;
• 802.1Q VLAN protocol;
• 9P file system network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Networking core;
• Distributed Switch Architecture;
• Ethtool driver;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Network traffic control;
• TIPC protocol;
• TLS protocol;
• Wireless networking;
• ALSA framework;
• WCD audio codecs;
• SoC Audio for Freescale CPUs drivers;
• SoC Audio generic drivers;
• Intel ASoC drivers;
• QCOM ASoC drivers;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-37806, CVE-2025-22084, CVE-2025-39688, CVE-2025-22030, CVE-2025-37754, CVE-2025-37783, CVE-2025-37825, CVE-2025-37752, CVE-2025-22104, CVE-2025-40014, CVE-2025-22103, CVE-2025-37874, CVE-2025-37773, CVE-2025-37741, CVE-2025-37763, CVE-2025-37859, CVE-2025-37779, CVE-2025-23155, CVE-2025-23143, CVE-2025-37788, CVE-2025-22028, CVE-2024-58096, CVE-2025-37842, CVE-2025-37854, CVE-2025-38637, CVE-2024-58097, CVE-2023-53034, CVE-2025-37797, CVE-2025-37851, CVE-2025-37941, CVE-2025-37942, CVE-2025-37748, CVE-2025-37982, CVE-2025-22058, CVE-2025-37781, CVE-2025-23130, CVE-2025-23149, CVE-2025-23146, CVE-2025-37809, CVE-2025-37801, CVE-2025-22080,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PA-RISC architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Serial ATA and Parallel ATA drivers;
• Bluetooth drivers;
• Bus devices;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• TI SCI PM domains driver;
• PWM drivers;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• TCM subsystem;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• Proc file system;
• SMB network file system;
• Kernel stack handling interfaces;
• Bluetooth subsystem;
• Network traffic control;
• SCTP protocol;
• BPF subsystem;
• Kernel command line parsing driver;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Networking core;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Phonet protocol;
• TIPC protocol;
• TLS protocol;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-37790, CVE-2025-37871, CVE-2025-23147, CVE-2025-37803, CVE-2025-37909, CVE-2025-37840, CVE-2025-37989, CVE-2025-37927, CVE-2024-50280, CVE-2024-50272, CVE-2025-37850, CVE-2024-35866, CVE-2025-22027, CVE-2025-37812, CVE-2025-21853, CVE-2025-37810, CVE-2025-37766, CVE-2024-54458, CVE-2022-21546, CVE-2025-37757, CVE-2025-37839, CVE-2024-38540, CVE-2025-37990, CVE-2025-37794, CVE-2024-53203, CVE-2025-37964, CVE-2025-37819, CVE-2024-50125, CVE-2024-53128, CVE-2022-48893, CVE-2023-52572, CVE-2024-42322, CVE-2024-35943, CVE-2025-37740, CVE-2025-37739, CVE-2025-37838, CVE-2025-37995, CVE-2025-37789, CVE-2024-50258, CVE-2025-37970, CVE-2025-38024, CVE-2025-23146, CVE-2025-37780, CVE-2022-49168, CVE-2025-23145, CVE-2024-46774, CVE-2022-49063, CVE-2025-37742, CVE-2025-37940, CVE-2025-37781, CVE-2025-37796, CVE-2025-23159, CVE-2025-23144, CVE-2025-37875, CVE-2024-49989, CVE-2025-37867, CVE-2025-37892, CVE-2025-37913, CVE-2024-38541, CVE-2025-37983, CVE-2025-37923, CVE-2025-37836, CVE-2025-23151, CVE-2025-37765, CVE-2025-37817, CVE-2025-37991, CVE-2025-38009, CVE-2025-37858, CVE-2025-37841, CVE-2025-37771, CVE-2025-22062, CVE-2025-37912, CVE-2025-23156, CVE-2022-49535, CVE-2025-37829, CVE-2025-37851, CVE-2024-46816, CVE-2025-37998, CVE-2025-38023, CVE-2024-56751, CVE-2025-37844, CVE-2025-37967, CVE-2025-37930, CVE-2025-37994, CVE-2025-37805, CVE-2024-46742, CVE-2025-37883, CVE-2025-21839, CVE-2025-37823, CVE-2025-23157, CVE-2025-37787, CVE-2025-38094, CVE-2024-26686, CVE-2024-26739, CVE-2025-23142, CVE-2025-23163, CVE-2025-37915, CVE-2025-37885, CVE-2024-27402, CVE-2025-37749, CVE-2025-37738, CVE-2025-37905, CVE-2025-37773, CVE-2025-23140, CVE-2025-37792, CVE-2025-37808, CVE-2024-49960, CVE-2025-37857, CVE-2025-23158, CVE-2025-37824, CVE-2023-52757, CVE-2025-37767, CVE-2025-37758,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PA-RISC architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Serial ATA and Parallel ATA drivers;
• Bluetooth drivers;
• Bus devices;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• TI SCI PM domains driver;
• PWM drivers;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• TCM subsystem;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• Proc file system;
• SMB network file system;
• Kernel stack handling interfaces;
• Bluetooth subsystem;
• Network traffic control;
• SCTP protocol;
• BPF subsystem;
• Kernel command line parsing driver;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Networking core;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Phonet protocol;
• TIPC protocol;
• TLS protocol;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-38024, CVE-2025-37787, CVE-2025-37741, CVE-2024-53128, CVE-2024-27402, CVE-2025-37794, CVE-2024-50280, CVE-2025-23146, CVE-2025-37862, CVE-2025-23151, CVE-2025-38023, CVE-2025-37797, CVE-2025-23140, CVE-2024-35866, CVE-2025-37940, CVE-2025-37738, CVE-2025-37905, CVE-2025-37766, CVE-2024-53203, CVE-2024-50125, CVE-2025-37995, CVE-2025-37949, CVE-2025-37915, CVE-2025-37839, CVE-2025-37812, CVE-2025-37857, CVE-2024-38541, CVE-2025-38094, CVE-2025-37789, CVE-2025-37867, CVE-2025-37770, CVE-2025-37927, CVE-2025-22062, CVE-2025-37805, CVE-2025-37841, CVE-2025-37970, CVE-2025-37913, CVE-2025-37859, CVE-2025-37830, CVE-2025-37780, CVE-2025-37994, CVE-2025-37840, CVE-2025-37967, CVE-2025-21853, CVE-2025-37790, CVE-2025-37914, CVE-2025-37982, CVE-2025-37808, CVE-2025-37740, CVE-2025-37803, CVE-2025-22027, CVE-2025-37765, CVE-2024-54458, CVE-2025-37912, CVE-2025-23161, CVE-2025-23159, CVE-2025-37875, CVE-2024-46774, CVE-2025-37991, CVE-2025-21839, CVE-2024-46751, CVE-2025-37998, CVE-2025-37810, CVE-2023-52757, CVE-2025-37851, CVE-2025-37749, CVE-2025-37871, CVE-2025-37792, CVE-2025-37757, CVE-2024-46816, CVE-2023-52572, CVE-2025-23150, CVE-2025-37923, CVE-2025-37964, CVE-2025-37892, CVE-2025-37989, CVE-2025-23142, CVE-2025-38009, CVE-2025-37767, CVE-2025-37911, CVE-2024-35943, CVE-2025-37844, CVE-2025-23158, CVE-2025-37796, CVE-2022-21546, CVE-2025-37829, CVE-2024-50272, CVE-2022-49063, CVE-2025-37969, CVE-2024-26686, CVE-2024-49989, CVE-2024-56751, CVE-2025-37742, CVE-2022-48893, CVE-2024-46742, CVE-2025-23157, CVE-2025-37781, CVE-2024-50258, CVE-2025-23148, CVE-2025-37983, CVE-2025-37771, CVE-2025-23144, CVE-2025-37858, CVE-2024-49960, CVE-2025-23163, CVE-2025-37881, CVE-2025-37883, CVE-2025-37773, CVE-2025-37836, CVE-2025-23156, CVE-2025-37885, CVE-2025-37811, CVE-2025-37758,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PA-RISC architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Serial ATA and Parallel ATA drivers;
• Bluetooth drivers;
• Bus devices;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• TI SCI PM domains driver;
• PWM drivers;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• TCM subsystem;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• Proc file system;
• SMB network file system;
• Kernel stack handling interfaces;
• Bluetooth subsystem;
• Network traffic control;
• SCTP protocol;
• BPF subsystem;
• Kernel command line parsing driver;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Networking core;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Phonet protocol;
• TIPC protocol;
• TLS protocol;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2022-49535, CVE-2025-37773, CVE-2025-37982, CVE-2025-37990, CVE-2025-37859, CVE-2025-37765, CVE-2025-37768, CVE-2025-23142, CVE-2025-37911, CVE-2024-56751, CVE-2025-37767, CVE-2025-37940, CVE-2024-50272, CVE-2025-37858, CVE-2025-38094, CVE-2025-37905, CVE-2025-37994, CVE-2025-38024, CVE-2024-26686, CVE-2025-37992, CVE-2025-37983, CVE-2025-23157, CVE-2025-37867, CVE-2025-37771, CVE-2025-38005, CVE-2025-37989, CVE-2025-37991, CVE-2025-37796, CVE-2025-23151, CVE-2025-37738, CVE-2025-37790, CVE-2023-52757, CVE-2025-37949, CVE-2025-37969, CVE-2025-37823, CVE-2023-52572, CVE-2025-37844, CVE-2024-46816, CVE-2025-37851, CVE-2024-53128, CVE-2025-37927, CVE-2025-23147, CVE-2025-37930, CVE-2024-49989, CVE-2022-49168, CVE-2025-37794, CVE-2025-37998, CVE-2025-37810, CVE-2024-46751, CVE-2025-37995, CVE-2025-37742, CVE-2025-37883, CVE-2024-46742, CVE-2024-54458, CVE-2025-37964, CVE-2025-38023, CVE-2025-37780, CVE-2022-49063, CVE-2025-37740, CVE-2025-37915, CVE-2025-37850, CVE-2025-37758, CVE-2025-23159, CVE-2024-50258, CVE-2025-37811, CVE-2025-37885, CVE-2025-23158, CVE-2025-37787, CVE-2025-37792, CVE-2025-23144, CVE-2025-37805, CVE-2025-21853, CVE-2025-23145, CVE-2025-37803, CVE-2025-37739, CVE-2025-37749, CVE-2025-37841, CVE-2022-21546, CVE-2025-37923, CVE-2025-22027, CVE-2025-37836, CVE-2022-48893, CVE-2025-37797, CVE-2025-23161, CVE-2024-50125, CVE-2025-37857, CVE-2025-23163, CVE-2024-49960, CVE-2025-37808, CVE-2025-37766, CVE-2025-23140, CVE-2025-23150, CVE-2025-22062, CVE-2025-23148, CVE-2025-37875, CVE-2025-37819, CVE-2025-37817, CVE-2025-37824, CVE-2024-35867, CVE-2025-37781, CVE-2024-35790, CVE-2025-21839, CVE-2025-37829, CVE-2025-37788, CVE-2024-35943, CVE-2025-37892, CVE-2024-38540, CVE-2025-37830, CVE-2025-37757, CVE-2025-37871, CVE-2024-26739, CVE-2024-27402, CVE-2025-37756,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PA-RISC architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Serial ATA and Parallel ATA drivers;
• Bluetooth drivers;
• Bus devices;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• TI SCI PM domains driver;
• PWM drivers;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• TCM subsystem;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• Proc file system;
• SMB network file system;
• Kernel stack handling interfaces;
• Bluetooth subsystem;
• Network traffic control;
• SCTP protocol;
• BPF subsystem;
• Kernel command line parsing driver;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Networking core;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Phonet protocol;
• TIPC protocol;
• TLS protocol;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-37767, CVE-2025-23151, CVE-2025-38005, CVE-2024-46816, CVE-2025-37812, CVE-2025-23159, CVE-2024-36908, CVE-2025-37930, CVE-2024-27402, CVE-2024-50125, CVE-2025-37881, CVE-2024-49989, CVE-2025-37964, CVE-2025-37739, CVE-2025-37792, CVE-2025-37742, CVE-2025-37875, CVE-2025-23144, CVE-2025-37836, CVE-2024-35866, CVE-2025-37738, CVE-2024-46774, CVE-2025-37817, CVE-2025-37781, CVE-2025-37757, CVE-2024-46751, CVE-2025-37867, CVE-2025-23158, CVE-2025-37885, CVE-2025-37756, CVE-2025-37788, CVE-2025-37994, CVE-2024-35867, CVE-2025-37905, CVE-2025-37883, CVE-2024-35943, CVE-2024-53128, CVE-2025-38009, CVE-2025-37940, CVE-2025-37992, CVE-2025-37796, CVE-2024-49960, CVE-2024-26686, CVE-2023-52757, CVE-2025-37841, CVE-2025-23148, CVE-2025-37851, CVE-2025-37808, CVE-2024-26739, CVE-2025-23161, CVE-2025-37859, CVE-2025-37839, CVE-2025-37982, CVE-2025-23142, CVE-2025-23140, CVE-2022-49168, CVE-2025-38024, CVE-2025-37949, CVE-2025-37790, CVE-2024-46742, CVE-2025-37780, CVE-2025-37911, CVE-2025-37840, CVE-2025-37768, CVE-2024-54458, CVE-2025-23150, CVE-2025-37969, CVE-2025-37749, CVE-2025-37995, CVE-2025-37789, CVE-2025-23146, CVE-2024-38541, CVE-2025-23163, CVE-2025-37770, CVE-2025-37871, CVE-2025-37740, CVE-2025-23157, CVE-2025-37741, CVE-2022-21546, CVE-2025-37909, CVE-2025-37991, CVE-2025-37913, CVE-2025-37803, CVE-2025-37797, CVE-2022-49063, CVE-2025-38023, CVE-2025-21839, CVE-2025-37811, CVE-2023-52572, CVE-2025-22027, CVE-2025-37765, CVE-2025-37892, CVE-2025-37810, CVE-2025-37914, CVE-2025-37850, CVE-2025-37858, CVE-2025-37794, CVE-2024-53203, CVE-2025-21853, CVE-2024-42322, CVE-2024-50258, CVE-2022-48893, CVE-2024-35790, CVE-2025-37787, CVE-2024-38540, CVE-2025-37915, CVE-2025-37819, CVE-2025-37838, CVE-2025-37998, CVE-2025-37771, CVE-2025-37983, CVE-2025-37844, CVE-2024-50272,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PA-RISC architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Serial ATA and Parallel ATA drivers;
• Bluetooth drivers;
• Bus devices;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• TI SCI PM domains driver;
• PWM drivers;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• TCM subsystem;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• Proc file system;
• SMB network file system;
• Kernel stack handling interfaces;
• Bluetooth subsystem;
• Network traffic control;
• SCTP protocol;
• BPF subsystem;
• Kernel command line parsing driver;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Networking core;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Phonet protocol;
• TIPC protocol;
• TLS protocol;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-37758, CVE-2025-37983, CVE-2025-37768, CVE-2025-37810, CVE-2025-23140, CVE-2025-37757, CVE-2024-35943, CVE-2022-49168, CVE-2024-54458, CVE-2024-56751, CVE-2025-37985, CVE-2025-37969, CVE-2025-37930, CVE-2025-38094, CVE-2025-37749, CVE-2025-37796, CVE-2024-46751, CVE-2025-37780, CVE-2025-37738, CVE-2025-37765, CVE-2024-35866, CVE-2025-37771, CVE-2025-37892, CVE-2024-50280, CVE-2025-37789, CVE-2025-21839, CVE-2023-52757, CVE-2025-37781, CVE-2025-38024, CVE-2024-50258, CVE-2023-52572, CVE-2025-23148, CVE-2024-27402, CVE-2025-37824, CVE-2025-37875, CVE-2025-37940, CVE-2025-37998, CVE-2025-37883, CVE-2024-26739, CVE-2025-37858, CVE-2024-53203, CVE-2025-37970, CVE-2025-23150, CVE-2025-23163, CVE-2025-23144, CVE-2025-38023, CVE-2025-37773, CVE-2025-37811, CVE-2025-37792, CVE-2025-37739, CVE-2025-37991, CVE-2025-37836, CVE-2025-37812, CVE-2022-49535, CVE-2025-37927, CVE-2025-37885, CVE-2025-23142, CVE-2025-23161, CVE-2024-53128, CVE-2025-37850, CVE-2025-37857, CVE-2025-37992, CVE-2025-37790, CVE-2024-49960, CVE-2025-37756, CVE-2025-37808, CVE-2025-37905, CVE-2024-50272, CVE-2025-37742, CVE-2025-37967, CVE-2025-37994, CVE-2024-42322, CVE-2025-37794, CVE-2025-37949, CVE-2025-37787, CVE-2025-37995, CVE-2024-35790, CVE-2024-46816, CVE-2024-46742, CVE-2025-23159, CVE-2022-49063, CVE-2025-37788, CVE-2025-37797, CVE-2025-37913, CVE-2025-37740, CVE-2025-37989, CVE-2025-37914, CVE-2025-23151, CVE-2022-48893, CVE-2025-37851, CVE-2025-23157, CVE-2025-37923, CVE-2025-23158, CVE-2025-37871, CVE-2025-37982, CVE-2025-37862, CVE-2022-21546, CVE-2025-37841, CVE-2025-37844, CVE-2024-35867, CVE-2025-23147, CVE-2025-37819, CVE-2024-49989, CVE-2025-37830, CVE-2025-38009, CVE-2024-46774, CVE-2025-37990, CVE-2025-37859, CVE-2025-37911, CVE-2024-38540, CVE-2025-37767, CVE-2025-37770, CVE-2025-22062,…

Michael Randrianantenaina discovered that the Bluetooth driver in the Linux Kernel contained an improper access control vulnerability. A nearby attacker could use this to connect a rougue device and possibly execute arbitrary code. (CVE-2024-8805)

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly verify the target namespace when handling upcalls. An attacker could use this to expose sensitive information. (CVE-2025-2312)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PA-RISC architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Bluetooth drivers;
• Bus devices;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• NTB driver;
• Device tree and open firmware driver;
• PCI subsystem;
• TI SCI PM domains driver;
• PWM drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• QCOM SoC drivers;
• Samsung SoC drivers;
• TCM subsystem;
• Thermal drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• Proc file system;
• SMB network file system;
• Kernel stack handling interfaces;
• Bluetooth subsystem;
• IPv6 networking;
• Network traffic control;
• SCTP protocol;
• RDMA verbs API;
• SoC audio core drivers;
• BPF subsystem;
• Kernel command line parsing driver;
• Tracing infrastructure;
• Watch queue notification mechanism;
• Memory management;
• 802.1Q VLAN protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• Networking core;
• IPv4 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Phonet protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• SoC Audio for Freescale CPUs drivers;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-37989, CVE-2025-22071, CVE-2025-37808, CVE-2025-37983, CVE-2025-38001, CVE-2024-46816, CVE-2024-50125, CVE-2025-38575, CVE-2025-37766, CVE-2022-49168, CVE-2025-22025, CVE-2025-22035, CVE-2025-37923, CVE-2024-49989, CVE-2025-23148, CVE-2024-53051, CVE-2025-39728, CVE-2025-21956, CVE-2025-37741, CVE-2025-37970, CVE-2025-37798, CVE-2025-23157, CVE-2025-38177, CVE-2022-49535, CVE-2025-22027, CVE-2025-37756, CVE-2025-38023, CVE-2025-22066, CVE-2025-37780, CVE-2025-37995, CVE-2025-37739, CVE-2025-37932, CVE-2025-37982, CVE-2025-37812, CVE-2025-23156, CVE-2025-38005, CVE-2025-21839, CVE-2025-37892, CVE-2025-22073, CVE-2024-35866, CVE-2023-52757, CVE-2025-37785, CVE-2025-23150, CVE-2024-58093, CVE-2025-21992, CVE-2025-37905, CVE-2025-37836, CVE-2025-21964, CVE-2025-23140, CVE-2025-22056, CVE-2025-37915, CVE-2025-22054,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PA-RISC architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Serial ATA and Parallel ATA drivers;
• Bluetooth drivers;
• Bus devices;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• TI SCI PM domains driver;
• PWM drivers;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• Proc file system;
• SMB network file system;
• Kernel stack handling interfaces;
• Bluetooth subsystem;
• Network traffic control;
• SCTP protocol;
• BPF subsystem;
• Kernel command line parsing driver;
• Tracing infrastructure;
• Memory management;
• 802.1Q VLAN protocol;
• Networking core;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Phonet protocol;
• TIPC protocol;
• TLS protocol;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2024-50280, CVE-2025-23159, CVE-2024-26686, CVE-2025-37797, CVE-2024-50047, CVE-2025-37810, CVE-2025-37796, CVE-2024-26739, CVE-2022-49535, CVE-2025-37808, CVE-2025-37824, CVE-2025-37923, CVE-2025-37885, CVE-2025-23145, CVE-2025-37913, CVE-2025-23144, CVE-2025-37767, CVE-2024-50258, CVE-2024-46742, CVE-2025-37819, CVE-2025-37794, CVE-2025-21853, CVE-2025-37858, CVE-2025-37766, CVE-2025-23156, CVE-2025-38083, CVE-2024-46787, CVE-2025-38009, CVE-2025-37881, CVE-2024-54458, CVE-2025-37940, CVE-2025-37911, CVE-2025-37792, CVE-2024-46816, CVE-2025-37738, CVE-2025-37851, CVE-2025-37749, CVE-2025-37994, CVE-2024-50272, CVE-2025-37915, CVE-2025-23140, CVE-2024-53203, CVE-2025-37969, CVE-2025-37995, CVE-2025-37930, CVE-2024-56751, CVE-2025-23146, CVE-2024-50125, CVE-2025-37998, CVE-2025-37787, CVE-2025-37798, CVE-2025-37742, CVE-2025-23148, CVE-2024-35866, CVE-2025-37982, CVE-2025-23142, CVE-2025-37964, CVE-2025-37768, CVE-2022-49063, CVE-2025-37949, CVE-2025-37990, CVE-2025-38094, CVE-2025-37788, CVE-2025-37857, CVE-2024-49960, CVE-2022-49168, CVE-2022-48893, CVE-2024-46774, CVE-2025-37905, CVE-2025-38001, CVE-2025-37992, CVE-2025-37841, CVE-2024-38541, CVE-2025-37862, CVE-2025-37912, CVE-2025-37838, CVE-2025-37771, CVE-2024-35867, CVE-2025-38023, CVE-2024-49989, CVE-2025-37997, CVE-2025-37970, CVE-2025-23151, CVE-2025-37758, CVE-2025-37844, CVE-2025-37871, CVE-2025-38024, CVE-2025-37914, CVE-2024-53051, CVE-2025-37829, CVE-2025-37770, CVE-2025-38000, CVE-2025-23163, CVE-2025-37875, CVE-2025-37927, CVE-2025-37850, CVE-2025-37839, CVE-2025-37780, CVE-2024-53128, CVE-2025-37883, CVE-2025-37740, CVE-2025-37840, CVE-2025-23150, CVE-2024-50073, CVE-2025-23158, CVE-2025-37909, CVE-2025-37789, CVE-2024-35943, CVE-2024-38540, CVE-2025-37739, CVE-2025-37985, CVE-2025-37932,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PA-RISC architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Serial ATA and Parallel ATA drivers;
• Bluetooth drivers;
• Bus devices;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• x86 platform drivers;
• TI SCI PM domains driver;
• PWM drivers;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Virtio drivers;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• Proc file system;
• SMB network file system;
• LZO compression library;
• Kernel stack handling interfaces;
• Bluetooth subsystem;
• Network traffic control;
• SCTP protocol;
• Digital Audio (PCM) driver;
• Tracing infrastructure;
• BPF subsystem;
• Padata parallel execution mechanism;
• Kernel command line parsing driver;
• Memory management;
• 802.1Q VLAN protocol;
• CAN network layer;
• Networking core;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Phonet protocol;
• TIPC protocol;
• TLS protocol;
• ALSA framework;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-37992, CVE-2025-37995, CVE-2025-38075, CVE-2025-37771, CVE-2025-38051, CVE-2025-37796, CVE-2022-49168, CVE-2025-37989, CVE-2025-38072, CVE-2025-37757, CVE-2024-46742, CVE-2024-50125, CVE-2024-42322, CVE-2022-49535, CVE-2025-37756, CVE-2025-37811, CVE-2025-37805, CVE-2025-37789, CVE-2025-22027, CVE-2025-37911, CVE-2025-37770, CVE-2025-37881, CVE-2025-37875, CVE-2025-37817, CVE-2024-26686, CVE-2025-37927, CVE-2025-38043, CVE-2025-38044, CVE-2025-23156, CVE-2025-38004, CVE-2025-37983, CVE-2025-37742, CVE-2025-23150, CVE-2025-23146, CVE-2025-21839, CVE-2025-37749, CVE-2024-50258, CVE-2025-37812, CVE-2025-37969, CVE-2025-37758, CVE-2024-27402, CVE-2025-37767, CVE-2025-37970, CVE-2025-23151, CVE-2025-37790, CVE-2025-37949, CVE-2024-38540, CVE-2025-37787, CVE-2025-37741, CVE-2025-37844, CVE-2025-37930, CVE-2024-46774, CVE-2025-37892, CVE-2025-37839, CVE-2025-37766, CVE-2025-37819, CVE-2025-37913, CVE-2025-37808, CVE-2025-37998, CVE-2024-56751, CVE-2025-21853, CVE-2024-36908, CVE-2025-37967, CVE-2025-38052, CVE-2025-37985, CVE-2025-37883, CVE-2025-37740, CVE-2025-37991, CVE-2025-38094, CVE-2025-23144, CVE-2024-50280, CVE-2025-37859, CVE-2024-50073, CVE-2025-23157, CVE-2025-37840, CVE-2025-38068, CVE-2025-37738, CVE-2025-23145, CVE-2025-37824, CVE-2025-38024, CVE-2025-38023, CVE-2025-38003, CVE-2025-38079, CVE-2025-37794, CVE-2025-37810, CVE-2025-37851, CVE-2024-53203, CVE-2024-35943, CVE-2025-23161, CVE-2025-37990, CVE-2024-35790, CVE-2024-50272, CVE-2024-35867,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PA-RISC architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Serial ATA and Parallel ATA drivers;
• Bluetooth drivers;
• Bus devices;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• x86 platform drivers;
• TI SCI PM domains driver;
• PWM drivers;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Virtio drivers;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• Proc file system;
• SMB network file system;
• LZO compression library;
• Kernel stack handling interfaces;
• Bluetooth subsystem;
• Network traffic control;
• SCTP protocol;
• Digital Audio (PCM) driver;
• Tracing infrastructure;
• BPF subsystem;
• Padata parallel execution mechanism;
• Kernel command line parsing driver;
• Memory management;
• 802.1Q VLAN protocol;
• CAN network layer;
• Networking core;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Phonet protocol;
• TIPC protocol;
• TLS protocol;
• ALSA framework;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-37766, CVE-2025-38044, CVE-2025-38003, CVE-2025-37990, CVE-2024-56751, CVE-2022-21546, CVE-2025-23148, CVE-2025-21853, CVE-2025-38043, CVE-2025-37844, CVE-2025-38048, CVE-2025-38034, CVE-2025-38072, CVE-2025-38177, CVE-2025-38005, CVE-2025-38068, CVE-2025-37765, CVE-2025-37808, CVE-2025-37787, CVE-2025-23145, CVE-2025-37756, CVE-2024-50272, CVE-2025-37857, CVE-2025-37819, CVE-2025-37789, CVE-2024-36908, CVE-2025-37812, CVE-2024-53128, CVE-2025-37788, CVE-2025-37892, CVE-2025-38001, CVE-2025-37773, CVE-2024-46816, CVE-2025-37823, CVE-2025-37838, CVE-2025-38066, CVE-2025-37771, CVE-2024-38541, CVE-2025-37927, CVE-2025-23142, CVE-2025-22062, CVE-2025-37811, CVE-2025-37969, CVE-2024-27402, CVE-2025-37911, CVE-2025-37740, CVE-2025-37913, CVE-2025-37810, CVE-2025-38094, CVE-2024-46787, CVE-2025-37749, CVE-2025-37983, CVE-2025-23157, CVE-2025-37790, CVE-2025-37739, CVE-2025-37995, CVE-2024-46774, CVE-2025-37758, CVE-2025-38065, CVE-2025-37909, CVE-2025-38009, CVE-2025-37915, CVE-2025-37932, CVE-2022-48893, CVE-2024-50125, CVE-2025-37841, CVE-2024-50047, CVE-2025-23140, CVE-2025-37780, CVE-2025-23156, CVE-2024-50280, CVE-2025-37840, CVE-2024-50258, CVE-2025-37796, CVE-2024-49960, CVE-2025-37829, CVE-2025-38024, CVE-2024-46751, CVE-2025-37985, CVE-2025-37989, CVE-2025-37994, CVE-2025-37741, CVE-2025-23151, CVE-2025-38058, CVE-2024-35790, CVE-2025-37871, CVE-2025-38031, CVE-2025-37940, CVE-2025-37930, CVE-2025-23150, CVE-2025-37805, CVE-2025-37738, CVE-2025-37850,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PA-RISC architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Serial ATA and Parallel ATA drivers;
• Bluetooth drivers;
• Bus devices;
• CPU frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• PCI Endpoint Test driver;
• MTD block device drivers;
• Network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• x86 platform drivers;
• TI SCI PM domains driver;
• PWM drivers;
• S/390 drivers;
• SCSI subsystem;
• Samsung SoC drivers;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Type-C support driver;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Virtio drivers;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• File systems infrastructure;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• Proc file system;
• SMB network file system;
• LZO compression library;
• Kernel stack handling interfaces;
• Bluetooth subsystem;
• Network traffic control;
• SCTP protocol;
• Digital Audio (PCM) driver;
• Tracing infrastructure;
• BPF subsystem;
• Padata parallel execution mechanism;
• Kernel command line parsing driver;
• Memory management;
• 802.1Q VLAN protocol;
• CAN network layer;
• Networking core;
• IPv6 networking;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Phonet protocol;
• TIPC protocol;
• TLS protocol;
• ALSA framework;
• Virtio sound driver;
• CPU Power monitoring subsystem; (CVE-2025-37766, CVE-2025-38044, CVE-2025-38003, CVE-2025-37990, CVE-2024-56751, CVE-2022-21546, CVE-2025-23148, CVE-2025-21853, CVE-2025-38043, CVE-2025-37844, CVE-2025-38048, CVE-2025-38034, CVE-2025-38072, CVE-2025-38177, CVE-2025-38005, CVE-2025-38068, CVE-2025-37765, CVE-2025-37808, CVE-2025-37787, CVE-2025-23145, CVE-2025-37756, CVE-2024-50272, CVE-2025-37857, CVE-2025-37819, CVE-2025-37789, CVE-2024-36908, CVE-2025-37812, CVE-2024-53128, CVE-2025-37788, CVE-2025-37892, CVE-2025-38001, CVE-2025-37773, CVE-2024-46816, CVE-2025-37823, CVE-2025-37838, CVE-2025-38066, CVE-2025-37771, CVE-2024-38541, CVE-2025-37927, CVE-2025-23142, CVE-2025-22062, CVE-2025-37811, CVE-2025-37969, CVE-2024-27402, CVE-2025-37911, CVE-2025-37740, CVE-2025-37913, CVE-2025-37810, CVE-2025-38094, CVE-2024-46787, CVE-2025-37749, CVE-2025-37983, CVE-2025-23157, CVE-2025-37790, CVE-2025-37739, CVE-2025-37995, CVE-2024-46774, CVE-2025-37758, CVE-2025-38065, CVE-2025-37909, CVE-2025-38009, CVE-2025-37915, CVE-2025-37932, CVE-2022-48893, CVE-2024-50125, CVE-2025-37841, CVE-2024-50047, CVE-2025-23140, CVE-2025-37780, CVE-2025-23156, CVE-2024-50280, CVE-2025-37840, CVE-2024-50258, CVE-2025-37796, CVE-2024-49960, CVE-2025-37829, CVE-2025-38024, CVE-2024-46751, CVE-2025-37985, CVE-2025-37989, CVE-2025-37994, CVE-2025-37741, CVE-2025-23151, CVE-2025-38058, CVE-2024-35790, CVE-2025-37871, CVE-2025-38031, CVE-2025-37940, CVE-2025-37930, CVE-2025-23150, CVE-2025-37805, CVE-2025-37738, CVE-2025-37850,…