CVE-2025-38181

In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr(). Since commit a1a5344ddbe8 ("tcp: avoid two atomic ops for syncookies"), reqsk->rsk_listener could be NULL when SYN Cookie is returned to its client, as hinted by the leading SYN Cookie log. Here are 3 options to fix the bug: 1) Return 0 in calipso_req_setattr() 2) Return an error in calipso_req_setattr() 3) Alaways set rsk_listener 1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie for CALIPSO. 3) is also no go as there have been many efforts to reduce atomic ops and make TCP robust against DDoS. See also commit 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood"). As of the blamed commit, SYN Cookie already did not need refcounting, and no one has stumbled on the bug for 9 years, so no CALIPSO user will care about SYN Cookie. Let's return an error in calipso_req_setattr() and calipso_req_delattr() in the SYN Cookie case. This can be reproduced by [1] on Fedora and now connect() of nc times out. [0]: TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 3 UID: 0 PID: 12262 Comm: syz.1.2611 Not tainted 6.14.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_pnet include/net/net_namespace.h:406 [inline] RIP: 0010:sock_net include/net/sock.h:655 [inline] RIP: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806 Code: 89 d5 41 54 55 89 f5 53 48 89 fb e8 25 e3 c6 fd e8 f0 91 e3 00 48 8d 7b 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 26 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b RSP: 0018:ffff88811af89038 EFLAGS: 00010216 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff888105266400 RDX: 0000000000000006 RSI: ffff88800c890000 RDI: 0000000000000030 RBP: 0000000000000050 R08: 0000000000000000 R09: ffff88810526640e R10: ffffed1020a4cc81 R11: ffff88810526640f R12: 0000000000000000 R13: 0000000000000820 R14: ffff888105266400 R15: 0000000000000050 FS: 00007f0653a07640(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f863ba096f4 CR3: 00000000163c0005 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <IRQ> ipv6_renew_options+0x279/0x950 net/ipv6/exthdrs.c:1288 calipso_req_setattr+0x181/0x340 net/ipv6/calipso.c:1204 calipso_req_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:597 netlbl_req_setattr+0x18a/0x440 net/netlabel/netlabel_kapi.c:1249 selinux_netlbl_inet_conn_request+0x1fb/0x320 security/selinux/netlabel.c:342 selinux_inet_conn_request+0x1eb/0x2c0 security/selinux/hooks.c:5551 security_inet_conn_request+0x50/0xa0 security/security.c:4945 tcp_v6_route_req+0x22c/0x550 net/ipv6/tcp_ipv6.c:825 tcp_conn_request+0xec8/0x2b70 net/ipv4/tcp_input.c:7275 tcp_v6_conn_request+0x1e3/0x440 net/ipv6/tcp_ipv6.c:1328 tcp_rcv_state_process+0xafa/0x52b0 net/ipv4/tcp_input.c:6781 tcp_v6_do_rcv+0x8a6/0x1a40 net/ipv6/tcp_ipv6.c:1667 tcp_v6_rcv+0x505e/0x5b50 net/ipv6/tcp_ipv6.c:1904 ip6_protocol_deliver_rcu+0x17c/0x1da0 net/ipv6/ip6_input.c:436 ip6_input_finish+0x103/0x180 net/ipv6/ip6_input.c:480 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_input+0x13c/0x6b0 net/ipv6/ip6_input.c:491 dst_input include/net/dst.h:469 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] ip6_rcv_finish+0xb6/0x490 net/ipv6/ip6_input.c:69 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netf ---truncated---

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

xfrm: state: fix out-of-bounds read during lookup

lookup and resize can run in parallel.

The xfrm_state_hash_generation seqlock ensures a retry, but the hash functions can observe a hmask value that is too large for the new hlist array.

rehash does: rcu_assign_pointer(net->xfrm.state_bydst, ndst) [..] net->xfrm.state_hmask = nhashmask;

While state lookup does: h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) {

This is only safe in case the update to state_bydst is larger than net->xfrm.xfrm_state_hmask (or if the lookup function gets serialized via state spinlock again).

Fix this by prefetching state_hmask and the associated pointers. The xfrm_state_hash_generation seqlock retry will ensure that the pointer and the hmask will be consistent.

The existing helpers, like xfrm_dst_hash(), are now unsafe for RCU side, add lockdep assertions to document that they are only safe for insert side.

xfrm_state_lookup_byaddr() uses the spinlock rather than RCU. AFAICS this is an oversight from back when state lookup was converted to RCU, this lock should be replaced with RCU in a future patch.(CVE-2024-57982)

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: always recalculate features after XDP clearing, fix null-deref

Recalculate features when XDP is detached.

Before:

ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp

ip li set dev eth0 xdp off

ethtool -k eth0 | grep gro

rx-gro-hw: off [requested on]

After:

ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp

ip li set dev eth0 xdp off

ethtool -k eth0 | grep gro

rx-gro-hw: on

The fact that HW-GRO doesn't get re-enabled automatically is just a minor annoyance. The real issue is that the features will randomly come back during another reconfiguration which just happens to invoke netdev_update_features(). The driver doesn't handle reconfiguring two things at a time very robustly.

Starting with commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") we only reconfigure the RSS hash table if the "effective" number of Rx rings has changed. If HW-GRO is enabled "effective" number of rings is 2x what user sees. So if we are in the bad state, with HW-GRO re-enablement "pending" after XDP off, and we lower the rings by / 2 - the HW-GRO rings doing 2x and the ethtool -L doing / 2 may cancel each other out, and the:

if (old_rx_rings != bp->hw_resc.resv_rx_rings &&

condition in __bnxt_reserve_rings() will be false. The RSS map won't get updated, and we'll crash with:

BUG: kernel NULL pointer dereference, address: 0000000000000168 RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0 bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180 __bnxt_setup_vnic_p5+0x58/0x110 bnxt_init_nic+0xb72/0xf50 __bnxt_open_nic+0x40d/0xab0 bnxt_open_nic+0x2b/0x60 ethtool_set_channels+0x18c/0x1d0

As we try to access a freed ring.

The issue is present since XDP support was added, really, but prior to commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") it wasn't causing major issues.(CVE-2025-21682)

In the Linux kernel, the following vulnerability has been resolved:

net: better track kernel sockets lifetime

While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device queues, due to skb_set_owner_w() prior calls.

This then trigger the following warning from ref_tracker_dir_exit() [1]

To fix this, make sure that kernel sockets own a reference on net->passive.

Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket is converted to a refcounted one.

[1]

[ 136.263918][ T35]…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

xfrm: state: fix out-of-bounds read during lookup

lookup and resize can run in parallel.

The xfrm_state_hash_generation seqlock ensures a retry, but the hash functions can observe a hmask value that is too large for the new hlist array.

rehash does: rcu_assign_pointer(net->xfrm.state_bydst, ndst) [..] net->xfrm.state_hmask = nhashmask;

While state lookup does: h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) {

This is only safe in case the update to state_bydst is larger than net->xfrm.xfrm_state_hmask (or if the lookup function gets serialized via state spinlock again).

Fix this by prefetching state_hmask and the associated pointers. The xfrm_state_hash_generation seqlock retry will ensure that the pointer and the hmask will be consistent.

The existing helpers, like xfrm_dst_hash(), are now unsafe for RCU side, add lockdep assertions to document that they are only safe for insert side.

xfrm_state_lookup_byaddr() uses the spinlock rather than RCU. AFAICS this is an oversight from back when state lookup was converted to RCU, this lock should be replaced with RCU in a future patch.(CVE-2024-57982)

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: always recalculate features after XDP clearing, fix null-deref

Recalculate features when XDP is detached.

Before:

ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp

ip li set dev eth0 xdp off

ethtool -k eth0 | grep gro

rx-gro-hw: off [requested on]

After:

ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp

ip li set dev eth0 xdp off

ethtool -k eth0 | grep gro

rx-gro-hw: on

The fact that HW-GRO doesn't get re-enabled automatically is just a minor annoyance. The real issue is that the features will randomly come back during another reconfiguration which just happens to invoke netdev_update_features(). The driver doesn't handle reconfiguring two things at a time very robustly.

Starting with commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") we only reconfigure the RSS hash table if the "effective" number of Rx rings has changed. If HW-GRO is enabled "effective" number of rings is 2x what user sees. So if we are in the bad state, with HW-GRO re-enablement "pending" after XDP off, and we lower the rings by / 2 - the HW-GRO rings doing 2x and the ethtool -L doing / 2 may cancel each other out, and the:

if (old_rx_rings != bp->hw_resc.resv_rx_rings &&

condition in __bnxt_reserve_rings() will be false. The RSS map won't get updated, and we'll crash with:

BUG: kernel NULL pointer dereference, address: 0000000000000168 RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0 bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180 __bnxt_setup_vnic_p5+0x58/0x110 bnxt_init_nic+0xb72/0xf50 __bnxt_open_nic+0x40d/0xab0 bnxt_open_nic+0x2b/0x60 ethtool_set_channels+0x18c/0x1d0

As we try to access a freed ring.

The issue is present since XDP support was added, really, but prior to commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") it wasn't causing major issues.(CVE-2025-21682)

In the Linux kernel, the following vulnerability has been resolved:

net: better track kernel sockets lifetime

While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device queues, due to skb_set_owner_w() prior calls.

This then trigger the following warning from ref_tracker_dir_exit() [1]

To fix this, make sure that kernel sockets own a reference on net->passive.

Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket is converted to a refcounted one.

[1]

[ 136.263918][ T35]…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

xfrm: state: fix out-of-bounds read during lookup

lookup and resize can run in parallel.

The xfrm_state_hash_generation seqlock ensures a retry, but the hash functions can observe a hmask value that is too large for the new hlist array.

rehash does: rcu_assign_pointer(net->xfrm.state_bydst, ndst) [..] net->xfrm.state_hmask = nhashmask;

While state lookup does: h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) {

This is only safe in case the update to state_bydst is larger than net->xfrm.xfrm_state_hmask (or if the lookup function gets serialized via state spinlock again).

Fix this by prefetching state_hmask and the associated pointers. The xfrm_state_hash_generation seqlock retry will ensure that the pointer and the hmask will be consistent.

The existing helpers, like xfrm_dst_hash(), are now unsafe for RCU side, add lockdep assertions to document that they are only safe for insert side.

xfrm_state_lookup_byaddr() uses the spinlock rather than RCU. AFAICS this is an oversight from back when state lookup was converted to RCU, this lock should be replaced with RCU in a future patch.(CVE-2024-57982)

In the Linux kernel, the following vulnerability has been resolved:

eth: bnxt: always recalculate features after XDP clearing, fix null-deref

Recalculate features when XDP is detached.

Before:

ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp

ip li set dev eth0 xdp off

ethtool -k eth0 | grep gro

rx-gro-hw: off [requested on]

After:

ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp

ip li set dev eth0 xdp off

ethtool -k eth0 | grep gro

rx-gro-hw: on

The fact that HW-GRO doesn't get re-enabled automatically is just a minor annoyance. The real issue is that the features will randomly come back during another reconfiguration which just happens to invoke netdev_update_features(). The driver doesn't handle reconfiguring two things at a time very robustly.

Starting with commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") we only reconfigure the RSS hash table if the "effective" number of Rx rings has changed. If HW-GRO is enabled "effective" number of rings is 2x what user sees. So if we are in the bad state, with HW-GRO re-enablement "pending" after XDP off, and we lower the rings by / 2 - the HW-GRO rings doing 2x and the ethtool -L doing / 2 may cancel each other out, and the:

if (old_rx_rings != bp->hw_resc.resv_rx_rings &&

condition in __bnxt_reserve_rings() will be false. The RSS map won't get updated, and we'll crash with:

BUG: kernel NULL pointer dereference, address: 0000000000000168 RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0 bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180 __bnxt_setup_vnic_p5+0x58/0x110 bnxt_init_nic+0xb72/0xf50 __bnxt_open_nic+0x40d/0xab0 bnxt_open_nic+0x2b/0x60 ethtool_set_channels+0x18c/0x1d0

As we try to access a freed ring.

The issue is present since XDP support was added, really, but prior to commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") it wasn't causing major issues.(CVE-2025-21682)

In the Linux kernel, the following vulnerability has been resolved:

net: better track kernel sockets lifetime

While kernel sockets are dismantled during pernet_operations->exit(), their freeing can be delayed by any tx packets still held in qdisc or device queues, due to skb_set_owner_w() prior calls.

This then trigger the following warning from ref_tracker_dir_exit() [1]

To fix this, make sure that kernel sockets own a reference on net->passive.

Add sk_net_refcnt_upgrade() helper, used whenever a kernel socket is converted to a refcounted one.

[1]

[ 136.263918][ T35]…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix ref leak when switching zones

When switching zones or network namespaces without doing a ct clear in between, it is now leaking a reference to the old ct entry. That's because tcf_ct_skb_nfct_cached() returns false and tcf_ct_flow_table_lookup() may simply overwrite it.

The fix is to, as the ct entry is not reusable, free it already at tcf_ct_skb_nfct_cached().(CVE-2022-49183)

In the Linux kernel, the following vulnerability has been resolved:

net: annotate races around sk->sk_bound_dev_if

UDP sendmsg() is lockless, and reads sk->sk_bound_dev_if while this field can be changed by another thread.

Adds minimal annotations to avoid KCSAN splats for UDP. Following patches will add more annotations to potential lockless readers.

BUG: KCSAN: data-race in __ip6_datagram_connect / udpv6_sendmsg

write to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0: __ip6_datagram_connect+0x6e2/0x930 net/ipv6/datagram.c:221 ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272 inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576 __sys_connect_file net/socket.c:1900 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1917 __do_sys_connect net/socket.c:1927 [inline] __se_sys_connect net/socket.c:1924 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:1924 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1: udpv6_sendmsg+0xc60/0x16e0 net/ipv6/udp.c:1436 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:652 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000000 -> 0xffffff9b

Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 7670 Comm: syz-executor.3 Tainted: G W 5.18.0-rc1-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

I chose to not add Fixes: tag because race has minor consequences and stable teams busy enough.(CVE-2022-49420)

A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.(CVE-2023-39179)

A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.(CVE-2023-4458)

In the Linux kernel, the following vulnerability has been resolved:

drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()

While receiving an MST up request message from one thread in drm_dp_mst_handle_up_req(), the MST topology could be removed from another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL. This could lead to a NULL deref/use-after-free of mst_primary in drm_dp_mst_handle_up_req().

Avoid the above by holding a…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix ref leak when switching zones

When switching zones or network namespaces without doing a ct clear in between, it is now leaking a reference to the old ct entry. That's because tcf_ct_skb_nfct_cached() returns false and tcf_ct_flow_table_lookup() may simply overwrite it.

The fix is to, as the ct entry is not reusable, free it already at tcf_ct_skb_nfct_cached().(CVE-2022-49183)

In the Linux kernel, the following vulnerability has been resolved:

net: annotate races around sk->sk_bound_dev_if

UDP sendmsg() is lockless, and reads sk->sk_bound_dev_if while this field can be changed by another thread.

Adds minimal annotations to avoid KCSAN splats for UDP. Following patches will add more annotations to potential lockless readers.

BUG: KCSAN: data-race in __ip6_datagram_connect / udpv6_sendmsg

write to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0: __ip6_datagram_connect+0x6e2/0x930 net/ipv6/datagram.c:221 ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272 inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576 __sys_connect_file net/socket.c:1900 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1917 __do_sys_connect net/socket.c:1927 [inline] __se_sys_connect net/socket.c:1924 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:1924 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1: udpv6_sendmsg+0xc60/0x16e0 net/ipv6/udp.c:1436 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:652 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000000 -> 0xffffff9b

Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 7670 Comm: syz-executor.3 Tainted: G W 5.18.0-rc1-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

I chose to not add Fixes: tag because race has minor consequences and stable teams busy enough.(CVE-2022-49420)

A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to disclose sensitive information on affected installations of Linux. Only systems with ksmbd enabled are vulnerable to this CVE.(CVE-2023-4458)

In the Linux kernel, the following vulnerability has been resolved:

drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()

While receiving an MST up request message from one thread in drm_dp_mst_handle_up_req(), the MST topology could be removed from another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL. This could lead to a NULL deref/use-after-free of mst_primary in drm_dp_mst_handle_up_req().

Avoid the above by holding a reference for mst_primary in drm_dp_mst_handle_up_req() while it's used.

v2: Fix kfreeing the request if getting an mst_primary reference fails.(CVE-2024-57798)

In the Linux kernel, the following vulnerability has been resolved:

net: sched: fix ets qdisc OOB Indexing

Haowei Yan <(CVE-2025-21692)

In the Linux kernel, the following vulnerability has been resolved:

net: sched: Disallow replacing of…

The Linux Kernel, the operating system core itself.

Security Fix(es):

A vulnerability was found in Linux Kernel up to 6.15.3 (Operating System). It has been rated as problematic.Using CWE to declare the problem leads to CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.Impacted is confidentiality, integrity, and availability.Upgrading to version 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4 or 6.16-rc1 eliminates this vulnerability. Applying the patch 119766de4930ff40db9f36b960cb53b0c400e81b/33163c68d2e3061fa3935b5f0a1867958b1cdbd2/9da3e442714f7f4393ff01c265c4959c03e88c2f/9a350f30d65197354706b7759b5c89d6c267b1a9/6bd2569d0b2f918e9581f744df0263caf73ee76c/4da7fcc098218ff92b2e83a43f545c02f714cedd/cdaa6d1cb2ff1219c6c822b27655dd170ffb0f72/9ad0452c0277b816a435433cca601304cfac7c21 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19447).(CVE-2025-38086)

In the Linux kernel, the following vulnerability has been resolved:

sch_hfsc: make hfsc_qlen_notify() idempotent

hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life:

1. update_vf() decreases cl->cl_nactive, so we can check whether it is non-zero before calling it.

2. eltree_remove() always removes RB node cl->el_node, but we can use RB_EMPTY_NODE() + RB_CLEAR_NODE() to make it safe.(CVE-2025-38177)

A vulnerability was found in Linux Kernel up to 6.16-rc2 (Operating System) and classified as critical.Using CWE to declare the problem leads to CWE-911. The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.Impacted is availability.Upgrading to version 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4 or 6.16-rc3 eliminates this vulnerability. Applying the patch 956f1499412ed0953f6a116df7fdb855e9f1fc66/f4ae0f61dd9a63329ecb49b1e6356139d43240b8/dc724bd34d56f5589f7587a091a8cda2386826c4/058dd4a370f23a5553a9449f2db53d5bfa88d45e/bde8833eb075ba8e8674de88e32de6b669966451/988edde4d52d5c02ea4dd95d7619372a5e2fb7b7/d092c7fd8e220b23d6c47e03d7d0cc79e731f379/10876da918fa1aec0227fb4c67647513447f53a9 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.(CVE-2025-38181)

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 6.15.3 (Operating System).The manipulation of the argument ext4_prepare_inline_data with an unknown input leads to a unknown weakness.This is going to have an impact on confidentiality, integrity, and availability.Upgrading to version 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4 or 6.16-rc1 eliminates this vulnerability. Applying the patch d3dfc60efd145df5324b99a244b0b05505cde29b/717414a8c083c376d4a8940a1230fe0c6ed4ee00/9d1d1c5bf4fc1af76be154d3afb2acdbd89ec7d8/cf5f319a2d8ab8238f8cf3a19463b9bff6420934/26e09d18599da0adc543eabd300080daaeda6869/5766da2237e539f259aa0e5f3639ae37b44ca458/e80ee0263d88d77f2fd1927f915003a7066cbb50/227cb4ca5a6502164f850d22aec3104d7888b270 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-20034).(CVE-2025-38222)

A vulnerability was found in Linux Kernel up to 6.16-rc4 (Operating System). It has been classified as critical.CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or…

Root has patched CVE-2025-38181 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-38181 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-38181 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-38181 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr(). Since commit a1a5344ddbe8 ("tcp: avoid two atomic ops for syncookies"), reqsk->rsk_listener could be NULL when SYN Cookie is returned to its client, as hinted by the leading SYN Cookie log. Here are 3 options to fix the bug: 1) Return 0 in calipso_req_setattr() 2) Return an error in calipso_req_setattr() 3) Alaways set rsk_listener 1) is no go as it bypasses LSM, but 2) effectively disables SYN Cookie for CALIPSO. 3) is also no go as there have been many efforts to reduce atomic ops and make TCP robust against DDoS. See also commit 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood"). As of the blamed commit, SYN Cookie already did not need refcounting, and no one has stumbled on the bug for 9 years, so no CALIPSO user will care about SYN Cookie. Let's return an error in calipso_req_setattr() and calipso_req_delattr() in the SYN Cookie case. This can be reproduced by [1] on Fedora and now connect() of nc times out. [0]: TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 3 UID: 0 PID: 12262 Comm: syz.1.2611 Not tainted 6.14.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_pnet include/net/net_namespace.h:406 [inline] RIP: 0010:sock_net include/net/sock.h:655 [inline] RIP: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806 Code: 89 d5 41 54 55 89 f5 53 48 89 fb e8 25 e3 c6 fd e8 f0 91 e3 00 48 8d 7b 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 26 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b RSP: 0018:ffff88811af89038 EFLAGS: 00010216 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff888105266400 RDX: 0000000000000006 RSI: ffff88800c890000 RDI: 0000000000000030 RBP: 0000000000000050 R08: 0000000000000000 R09: ffff88810526640e R10: ffffed1020a4cc81 R11: ffff88810526640f R12: 0000000000000000 R13: 0000000000000820 R14: ffff888105266400 R15: 0000000000000050 FS: 00007f0653a07640(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f863ba096f4 CR3: 00000000163c0005 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <IRQ> ipv6_renew_options+0x279/0x950 net/ipv6/exthdrs.c:1288 calipso_req_setattr+0x181/0x340 net/ipv6/calipso.c:1204 calipso_req_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:597 netlbl_req_setattr+0x18a/0x440 net/netlabel/netlabel_kapi.c:1249 selinux_netlbl_inet_conn_request+0x1fb/0x320 security/selinux/netlabel.c:342 selinux_inet_conn_request+0x1eb/0x2c0 security/selinux/hooks.c:5551 security_inet_conn_request+0x50/0xa0 security/security.c:4945 tcp_v6_route_req+0x22c/0x550 net/ipv6/tcp_ipv6.c:825 tcp_conn_request+0xec8/0x2b70 net/ipv4/tcp_input.c:7275 tcp_v6_conn_request+0x1e3/0x440 net/ipv6/tcp_ipv6.c:1328 tcp_rcv_state_process+0xafa/0x52b0 net/ipv4/tcp_input.c:6781 tcp_v6_do_rcv+0x8a6/0x1a40 net/ipv6/tcp_ipv6.c:1667 tcp_v6_rcv+0x505e/0x5b50 net/ipv6/tcp_ipv6.c:1904 ip6_protocol_deliver_rcu+0x17c/0x1da0 net/ipv6/ip6_input.c:436 ip6_input_finish+0x103/0x180 net/ipv6/ip6_input.c:480 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_input+0x13c/0x6b0 net/ipv6/ip6_input.c:491 dst_input include/net/dst.h:469 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] ip6_rcv_finish+0xb6/0x490 net/ipv6/ip6_input.c:69 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netf ---truncated---

In the Linux kernel, the following vulnerability has been resolved:

calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().

syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0]

The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr().

Since commit a1a5344ddbe8 ("tcp: avoid two atomic ops for syncookies"), reqsk->rsk_listener could be NULL when SYN Cookie is returned to its client, as hinted by the leading SYN Cookie log.

Here are 3 options to fix the bug:

1. Return 0 in calipso_req_setattr()

2. Return an error in calipso_req_setattr()

3. Alaways set rsk_listener

4. is no go as it bypasses LSM, but 2) effectively disables SYN Cookie for CALIPSO. 3) is also no go as there have been many efforts to reduce atomic ops and make TCP robust against DDoS. See also commit 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood").

As of the blamed commit, SYN Cookie already did not need refcounting, and no one has stumbled on the bug for 9 years, so no CALIPSO user will care about SYN Cookie.

Let's return an error in calipso_req_setattr() and calipso_req_delattr() in the SYN Cookie case.

This can be reproduced by [1] on Fedora and now connect() of nc times out.

[0]: TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 3 UID: 0 PID: 12262 Comm: syz.1.2611 Not tainted 6.14.0 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_pnet include/net/net_namespace.h:406 [inline] RIP: 0010:sock_net include/net/sock.h:655 [inline] RIP: 0010:sock_kmalloc+0x35/0x170 net/core/sock.c:2806 Code: 89 d5 41 54 55 89 f5 53 48 89 fb e8 25 e3 c6 fd e8 f0 91 e3 00 48 8d 7b 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 26 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b RSP: 0018:ffff88811af89038 EFLAGS: 00010216 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff888105266400 RDX: 0000000000000006 RSI: ffff88800c890000 RDI: 0000000000000030 RBP: 0000000000000050 R08: 0000000000000000 R09: ffff88810526640e R10: ffffed1020a4cc81 R11: ffff88810526640f R12: 0000000000000000 R13: 0000000000000820 R14: ffff888105266400 R15: 0000000000000050 FS: 00007f0653a07640(0000) GS:ffff88811af80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f863ba096f4 CR3: 00000000163c0005 CR4: 0000000000770ef0 PKRU: 80000000 Call Trace: <IRQ> ipv6_renew_options+0x279/0x950 net/ipv6/exthdrs.c:1288 calipso_req_setattr+0x181/0x340 net/ipv6/calipso.c:1204 calipso_req_setattr+0x56/0x80 net/netlabel/netlabel_calipso.c:597 netlbl_req_setattr+0x18a/0x440 net/netlabel/netlabel_kapi.c:1249 selinux_netlbl_inet_conn_request+0x1fb/0x320 security/selinux/netlabel.c:342 selinux_inet_conn_request+0x1eb/0x2c0 security/selinux/hooks.c:5551 security_inet_conn_request+0x50/0xa0 security/security.c:4945 tcp_v6_route_req+0x22c/0x550 net/ipv6/tcp_ipv6.c:825 tcp_conn_request+0xec8/0x2b70 net/ipv4/tcp_input.c:7275 tcp_v6_conn_request+0x1e3/0x440 net/ipv6/tcp_ipv6.c:1328 tcp_rcv_state_process+0xafa/0x52b0 net/ipv4/tcp_input.c:6781 tcp_v6_do_rcv+0x8a6/0x1a40 net/ipv6/tcp_ipv6.c:1667 tcp_v6_rcv+0x505e/0x5b50 net/ipv6/tcp_ipv6.c:1904 ip6_protocol_deliver_rcu+0x17c/0x1da0 net/ipv6/ip6_input.c:436 ip6_input_finish+0x103/0x180 net/ipv6/ip6_input.c:480 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip6_input+0x13c/0x6b0 net/ipv6/ip6_input.c:491 dst_input include/net/dst.h:469 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] ip6_rcv_finish+0xb6/0x490 net/ipv6/ip6_input.c:69 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netf ---truncated---

• rds: tcp: block BH in TCP callbacks
• kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges
• module: correctly exit module_kallsyms_on_each_symbol when fn() != 0
• module: potential uninitialized return in module_kallsyms_on_each_symbol()
• module: use RCU to synchronize find_module
• kallsyms: refactor {,module_}kallsyms_on_each_symbol
• LTS tag: v5.4.295
• scsi: qedf: Use designated initializer for struct qed_fcoe_cb_ops
• arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320}
• perf: Fix sample vs do_exit() {CVE-2025-38424}
• s390/pci: Fix __pcilg_mio_inuser() inline assembly
• rtc: test: Fix invalid format specifier.
• jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
• mm/huge_memory: fix dereferencing invalid pmd migration entry {CVE-2025-37958}
• rtc: Make rtc_time64_to_tm() support dates before 1970
• rtc: Improve performance of rtc_time64_to_tm(). Add tests.
• xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create {CVE-2022-48773}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• ARM: dts: am335x-bone-common: Increase MDIO reset deassert delay to 50ms
• ARM: dts: am335x-bone-common: Increase MDIO reset deassert time
• ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board
• net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
• net: atm: add lec_mutex {CVE-2025-38323}
• calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
• tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
• tcp: fix tcp_packet_delayed() for tcp_is_non_sack_preventing_reopen() behavior
• atm: atmtcp: Free invalid length skb in atmtcp_c_send(). {CVE-2025-38185}
• mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
• wifi: carl9170: do not ping device which has failed to load firmware {CVE-2025-38420}
• aoe: clean device rq_list in aoedev_downdev() {CVE-2025-38326}
• hwmon: (occ) fix unaligned accesses
• drm/nouveau/bl: increase buffer size to avoid truncate warning
• erofs: remove unused trace event erofs_destroy_inode
• ALSA: hda/realtek: enable headset mic on Latitude 5420 Rugged
• ALSA: hda/intel: Add Thinkpad E15 to PM deny list
• Input: sparcspkr - avoid unannotated fall-through
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
• selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len
• scsi: s390: zfcp: Ensure synchronous unit_add
• scsi: storvsc: Increase the timeouts to storvsc_timeout
• jffs2: check jffs2_prealloc_raw_node_refs() result in few other places {CVE-2025-38328}
• jffs2: check that raw node were preallocated before writing summary {CVE-2025-38194}
• drivers/rapidio/rio_cm.c: prevent possible heap overwrite {CVE-2025-38090}
• powerpc/eeh: Fix missing PE bridge reconfiguration during VFIO EEH recovery
• platform/x86: dell_rbu: Stop overwriting data buffer
• platform: Add Surface platform directory
• Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
• tee: Prevent size calculation wraparound on 32-bit kernels
• ARM: OMAP2+: Fix l4ls clk domain handling in STANDBY
• bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value
• watchdog: da9052_wdt: respect TWDMIN
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• sock: Correct error checking condition for (assign|release)_proto_idx()
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• vxlan: Do not treat dst cache initialization errors as fatal
• clk: rockchip: rk3036: mark ddrphy as critical
• wifi: mac80211: do not offer a mesh path if forwarding is disabled
• net: mlx4: add SOF_TIMESTAMPING_TX_SOFTWARE flag when getting ts info
• pinctrl: armada-37xx: propagate error from armada_37xx_gpio_get()
• pinctrl: armada-37xx:…

• crypto: algif_aead - Fix minimum RX size check for decryption {CVE-2026-31431}
• crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl {CVE-2026-31431}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-31431}
• crypto: authencesn - Fix src offset when decrypting in-place {CVE-2026-31431}
• crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption {CVE-2026-31431}
• crypto: authenc - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
• crypto: algif_aead - snapshot IV for async AEAD requests {CVE-2026-31431}
• crypto: algif_aead - Revert to operating out-of-place {CVE-2026-31431}
• crypto: algif_aead - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
• crypto: scatterwalk - Backport memcpy_sglist() {CVE-2026-31431}
• wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• intel_th: msu: Fix vmalloced buffers {CVE-2022-50142}
• vt: Clear selection before changing the font {CVE-2022-49948}
• ACPICA: Fix error code path in acpi_ds_call_control_method() {CVE-2022-50411}
• usbnet: Run unregister_netdev() before unbind_all() {CVE-2022-50220}
• ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
• bpf: Propagate error from htab_lock_bucket() to userspace {CVE-2022-50490}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• module: fix [e_shstrndx].sh_size=0 OOB access {CVE-2022-49444}
• ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
• tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
• xsk: Fix xsk_diag use-after-free error during socket cleanup {CVE-2023-53426}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• net: hns3: add VLAN id validation before using {CVE-2025-71112}
• net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• staging: vme_user: Fix possible UAF in tsi148_dma_list_add {CVE-2022-50384}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• ftrace: Add cond_resched() to ftrace_graph_set_hash() {CVE-2025-37940}
• net: stmmac: Fix accessing freed irq affinity_hint {CVE-2025-23155}
• ext4: set goal start correctly in ext4_mb_normalize_request {CVE-2023-54021}
• netfilter: ipset: fix region locking in hash types {CVE-2025-37997}
• openvswitch: Fix unsafe attribute parsing in output_userspace() {CVE-2025-37998}
• wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() {CVE-2025-37990}
• nfs: handle failure of nfs_get_lock_context in unlock path {CVE-2025-38023}
• drm/amd/pm: Prevent division by zero {CVE-2025-37767}
• netfilter: ctnetlink: remove refcounting in expectation dumpers {CVE-2025-39764}
• tracing: Fix null pointer dereference in tracing_err_log_open() {CVE-2023-53167}
• ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
• scsi: qla2xxx: Pointer may be dereferenced {CVE-2023-53150}
• net: pktgen: fix access outside of user given buffer in pktgen_thread_write() {CVE-2025-38061}
• dm cache: prevent BUG_ON by blocking retries on failed device resumes {CVE-2025-38066} -…

• crypto: algif_aead - Fix minimum RX size check for decryption {CVE-2026-31431}
• crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl {CVE-2026-31431}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-31431}
• crypto: authencesn - Fix src offset when decrypting in-place {CVE-2026-31431}
• crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption {CVE-2026-31431}
• crypto: authenc - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
• crypto: algif_aead - snapshot IV for async AEAD requests {CVE-2026-31431}
• crypto: algif_aead - Revert to operating out-of-place {CVE-2026-31431}
• crypto: algif_aead - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
• crypto: scatterwalk - Backport memcpy_sglist() {CVE-2026-31431}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
• ptp: fix integer overflow in max_vclocks_store {CVE-2024-40994}
• xsk: Fix xsk_diag use-after-free error during socket cleanup {CVE-2023-53426}
• net: hns3: add VLAN id validation before using {CVE-2025-71112}
• scsi: qla2xxx: Fix improper freeing of purex item {CVE-2025-68741}
• tracing: Consider the NULL character when validating the event length {CVE-2024-50131}
• capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() {CVE-2026-23111}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• libceph: replace overzealous BUG_ON in osdmap_apply_incremental() {CVE-2026-22990}
• RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert {CVE-2025-38387}
• ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
• drm/tegra: Fix a possible null pointer dereference {CVE-2025-38363}
• ACPICA: fix acpi operand cache leak in dswstate.c {CVE-2025-38345}
• ACPICA: fix acpi parse and parseext cache leaks {CVE-2025-38344}
• jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
• x86/sgx: Prevent attempts to reclaim poisoned pages {CVE-2025-38334}
• mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
• drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table {CVE-2025-38319}
• fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() {CVE-2025-38312}
• seg6: Fix validation of nexthop addresses {CVE-2025-38310}
• bpf: Fix WARN() in get_bpf_raw_tp_regs {CVE-2025-38285}
• atm: clip: prevent NULL deref in clip_push() {CVE-2025-38251}
• nfsd: Initialize ssc before laundromat_work to prevent NULL dereference {CVE-2025-38231}
• ext4: inline: fix len overflow in ext4_prepare_inline_data {CVE-2025-38222}
• fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38215}
• fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38214}
• atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
• tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
• calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
• thunderbolt: Do not double dequeue a configuration request {CVE-2025-38174}
• bpf: fix ktls panic with sockmap {CVE-2025-38166}
• gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO {CVE-2025-38122}
• net_sched: sch_sfq: fix a potential crash on gso_skb handling {CVE-2025-38115}
• x86/iopl: Cure TIF_IO_BITMAP inconsistencies {CVE-2025-38100}
• dma-buf: insert memory barrier before updating num_fences {CVE-2025-38095}
• net_sched: prio: fix a race in prio_tune() {CVE-2025-38083} -…

Vanilla upstream kernel version 6.6.101 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Upstream kernel version 6.6.101 fixes bugs and vulnerabilities. The kmod-virtualbox, kmod-xtables-addons & wireless-regdb packages have been updated to work with this new kernel. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise Server 16.0 and SUSE Linux Micro 6.2 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2024-57891: sched_ext: Fix invalid irq restore in scx_ops_bypass() (bsc#1235953).
• CVE-2024-57951: hrtimers: Handle CPU state correctly on hotplug (bsc#1237108).
• CVE-2024-57952: Revert "libfs: fix infinite directory reads for offset dir" (bsc#1237131).
• CVE-2024-58090: sched/core: Prevent rescheduling when interrupts are disabled (bsc#1240324).
• CVE-2025-22034: mm/rmap: avoid -EBUSY from make_device_exclusive() (bsc#1241435).
• CVE-2025-22077: Revert "smb: client: fix TCP timers deadlock after rmmod" (bsc#1241403).
• CVE-2025-23141: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses (bsc#1242782).
• CVE-2025-37821: sched/eevdf: Fix se->slice being set to U64_MAX and resulting (bsc#1242864).
• CVE-2025-37849: KVM: arm64: Tear down vGIC on failed vCPU creation (bsc#1243000).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-38006: net: mctp: Do not access ifa_index when missing (bsc#1244930).
• CVE-2025-38008: mm/page_alloc: fix race condition in unaccepted memory handling (bsc#1244939).
• CVE-2025-38019: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices (bsc#1245000).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38038: cpufreq: amd-pstate: Remove unnecessary driver_lock in set_boost (bsc#1244812).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection (bsc#1244734).
• CVE-2025-38101: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() (bsc#1245659).
• CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() (bsc#1245663).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38119: scsi: core: ufs: Fix a hang in the error handler (bsc#1245700).
• CVE-2025-38125: net: stmmac: make sure that ptp_rate is not 0 before configuring EST (bsc#1245710).
• CVE-2025-38146: net: openvswitch: Fix the dead loop of MPLS parse (bsc#1245767).
• CVE-2025-38160: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() (bsc#1245780).
• CVE-2025-38168: perf: arm-ni: Unregister PMUs on probe failure (bsc#1245763).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956).
• CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send() (bsc#1246012).
• CVE-2025-38190: atm: Revert atm_account_tx() if copy_from_iter_full() fails (bsc#1245973).
• CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (bsc#1245977).
• CVE-2025-38205: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 (bsc#1246005).
• CVE-2025-38208: smb: client: add NULL check in automount_fullpath (bsc#1245815).
• CVE-2025-38216: iommu/vt-d: Restore context entry setup order for aliased devices (bsc#1245963).
• CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
• CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data (bsc#1245976).
• CVE-2025-38242: mm: userfaultfd: fix race of userfaultfd_move and swap…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2024-57947: netfilter: nf_set_pipapo: fix initial map fill (bsc#1236333).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38289: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (bsc#1246287).

The following non-security bugs were fixed:

• Revert 'hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).'
• Revert 'mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race'
• Revert 'mm/hugetlb: unshare page tables during VMA split, not before'
• bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (bsc#1244523).
• net: usb: usbnet: restore usb%d name exception for local mac addresses (bsc#1234480 bsc#1246555).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46984: Fixed an out of bounds access in kyber_bio_merge() in kyber (bsc#1220631).
• CVE-2021-46987: btrfs: fix deadlock when cloning inline extents and using qgroups (bsc#1220704).
• CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference (bsc#1205711).
• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2022-49319: iommu/arm-smmu-v3: check return value after calling platform_get_resource() (bsc#1238374).
• CVE-2022-49323: iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() (bsc#1238400).
• CVE-2022-49768: 9p/fd: fix issue of list_del corruption in p9_fd_cancel() (bsc#1242446).
• CVE-2022-49825: ata: libata-transport: fix error handling in ata_tport_add() (bsc#1242548).
• CVE-2022-49934: wifi: mac80211: Fix UAF in ieee80211_scan_rx() (bsc#1245051).
• CVE-2022-49948: vt: Clear selection before changing the font (bsc#1245058).
• CVE-2022-49969: drm/amd/display: clear optc underflow before turn off odm clock (bsc#1245060).
• CVE-2022-49993: loop: Check for overflow while configuring loop (bsc#1245121).
• CVE-2022-50025: cxl: Fix a memory leak in an error handling path (bsc#1245132).
• CVE-2022-50027: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE (bsc#1245073).
• CVE-2022-50030: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input (bsc#1245265).
• CVE-2022-50033: usb: host: ohci-ppc-of: Fix refcount leak bug (bsc#1245139).
• CVE-2022-50103: sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed (bsc#1244840).
• CVE-2022-50149: driver core: fix potential deadlock in __driver_attach (bsc#1244883).
• CVE-2022-50226: crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak (bsc#1244860).
• CVE-2023-2176: Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA (bsc#1210629).
• CVE-2023-52878: can: dev: can_put_echo_skb(): do not crash kernel if can_priv::echo_skb is accessed out of bounds (bsc#1225000).
• CVE-2023-53020: l2tp: close all race conditions in l2tp_tunnel_register() (bsc#1240224).
• CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
• CVE-2023-53118: scsi: core: Fix a procfs host directory removal regression (bsc#1242365).
• CVE-2024-26974: crypto: qat - resolve race condition during AER recovery (bsc#1223638).
• CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-46713: kabi fix for perf/aux: Fix AUX buffer serialization (bsc#1230581).
• CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
• CVE-2025-21731: nbd: do not allow reconnect after disconnect (bsc#1237881).
• CVE-2025-21928: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (bsc#1240722).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38040: serial: mctrl_gpio: split disable_ms into sync and no_sync APIs (bsc#1245078).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for…

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50211: md-raid10: fix KASAN warning (bsc#1245140).
• CVE-2023-2176: Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA (bsc#1210629).
• CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
• CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
• CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
• CVE-2025-38477: net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (bsc#1247314).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
• CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The following non-security bugs were fixed:

• Revert 'hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).'
• Revert 'mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race'
• Revert 'mm/hugetlb: unshare page tables during VMA split, not before'

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
• CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2023-53117: fs: prevent out-of-bounds array speculation when closing a file descriptor (bsc#1242780).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-42265: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (bsc#1229334).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2025-21881: uprobes: Reject the shared zeropage in uprobe_write_opcode() (bsc#1240185).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
• CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
• CVE-2025-38477: net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (bsc#1247314).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
• CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The following non-security bugs were fixed:

• Revert 'hugetlb: unshare some PMDs when splitting VMAs (bsc#1245431).'
• Revert 'mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race'
• Revert 'mm/hugetlb: unshare page tables during VMA split, not before'

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160).
• CVE-2023-52923: netfilter: nf_tables: split async and sync catchall in two functions (bsc#1236104).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-53057: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (bsc#1233551).
• CVE-2024-53164: net: sched: fix ordering of qlen adjustment (bsc#1234863).
• CVE-2025-21701: net: avoid race between device unregistration and ethnl ops (bsc#1237164).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1242417).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245217).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246000).
• CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (bsc#1246045).
• CVE-2025-38206: exfat: fix double free in delayed_free (bsc#1246073).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246029).
• CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll() (bsc#1246037).
• CVE-2025-38257: s390/pkey: Prevent overflow in size calculation for memdup_user() (bsc#1246186).
• CVE-2025-38289: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (bsc#1246287).
• CVE-2025-38350: net/sched: Always pass notifications when child class becomes empty (bsc#1246781).
• CVE-2025-38468: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree (bsc#1247437).
• CVE-2025-38477: net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (bsc#1247314).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247349).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247348).
• CVE-2025-38497: usb: gadget: configfs: Fix OOB read on empty string write (bsc#1247347).

The following non-security bugs were fixed:

• Revert 'hugetlb: unshare some PMDs when splitting VMAs' (bsc#1245431).
• Revert 'mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race'
• Revert 'mm/hugetlb: unshare page tables during VMA split, not before'
• bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (bsc#1244523).
• net: usb: usbnet: restore usb%d name exception for local mac addresses (bsc#1234480 bsc#1246555).

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-42134: virtio-pci: Check if is_avq is NULL (bsc#1228664 bsc#1247831).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38047: x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
• CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
• CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
• CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
• CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
• CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
• CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
• CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
• CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
• CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
• CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
• CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
• CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
• CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
• CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in…

The SUSE Linux Enterprise 15 SP6 Confidential Computing kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-11135: TSX Asynchronous Abort condition (bsc#1139073).
• CVE-2023-52888: media: mediatek: vcodec: Only free buffer VA that is not NULL (bsc#1228557).
• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-49568: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg (bsc#1235728).
• CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
• CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
• CVE-2024-58053: rxrpc: Fix handling of received connection abort (bsc#1238982).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38220: ext4: only dirty folios when data journaling regular files (bsc#1245966).
• CVE-2025-38244: smb: client: fix potential deadlock when reconnecting channels (bsc#1246183).
• CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (bsc#1246911).
• CVE-2025-38371: drm/v3d: Disable interrupts before resetting the GPU (bsc#1247178).
• CVE-2025-38392: idpf: convert control queue mutex to a spinlock (bsc#1247169).
• CVE-2025-38399: scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port() (bsc#1247097).
• CVE-2025-38426: drm/amdgpu: Add basic validation for RAS header (bsc#1247252).
• CVE-2025-38457: net/sched: Abort __tc_modify_qdisc if parent class does not exist (bsc#1247098).
• CVE-2025-38460: atm: clip: Fix potential null-ptr-deref in to_atmarpd() (bsc#1247143).
• CVE-2025-38465: netlink: make sure we allow at least one dump skb (bsc#1247118).
• CVE-2025-38470: kABI fix for net: vlan: fix VLAN 0 refcount imbalance of toggling (bsc#1247288).
• CVE-2025-38471: tls: always refresh the queue when reading sock (bsc#1247450).
• CVE-2025-38490: net: libwx: remove duplicate page_pool_put_full_page() (bsc#1247243).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247374).
• CVE-2025-21720: xfrm: delete intermediate secpath entry in packet offload mode (bsc#1238859).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21868: kABI workaround for adding an header (bsc#1240180).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
• CVE-2025-21899: tracing: Fix bad hist from corrupting named_triggers list (bsc#1240577).
• CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
• CVE-2025-21938: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr (bsc#1240723).
• CVE-2025-21959: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() (bsc#1240814).
• CVE-2025-21997: xsk: fix an integer overflow in xp_create_and_assign_umem() (bsc#1240823).
• CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (bsc#1241544).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-22111: kABI fix for net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF (bsc#1241572).
• CVE-2025-22113: ext4: define ext4_journal_destroy wrapper (bsc#1241617).
• CVE-2025-23155: net: stmmac: Fix accessing freed irq affinity_hint (bsc#1242573).
• CVE-2025-23163: net:…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
• CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
• CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
• CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
• CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
• CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
• CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
• CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
• CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
• CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
• CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
• CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
• CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
• CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
• CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
• CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in…

The SUSE Linux Enterprise 15 SP6 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (1230216).
• CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
• CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
• CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
• CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
• CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
• CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
• CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
• CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
• CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
• CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
• CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
• CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
• CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
• CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
• CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
• CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in…

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-11135: enabled CONFIG_X86_INTEL_TSX_MODE_AUTO (bsc#1139073, bsc#1246695)
• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-39298:mm/memory-failure: fix handling of dissolved but not taken off from buddy pages (bsc#1227082).
• CVE-2024-42134: virtio-pci: Check if is_avq is NULL (bsc#1228664).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38047: x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
• CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
• CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
• CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
• CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
• CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
• CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
• CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
• CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
• CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
• CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
• CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
• CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-11135: enabled CONFIG_X86_INTEL_TSX_MODE_AUTO (bsc#1139073, bsc#1246695).
• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-39298:mm/memory-failure: fix handling of dissolved but not taken off from buddy pages (bsc#1227082).
• CVE-2024-42134: virtio-pci: Check if is_avq is NULL (bsc#1228664 bsc#1247831).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-49861: net: clear the dst when changing skb protocol (bsc#1245954).
• CVE-2024-49996: cifs: Fix buffer overflow when parsing NFS reparse points (bsc#1232089).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21854: selftest/bpf: Add vsock test for sockmap rejecting unconnected (bsc#1239470).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-22090: mm: (un)track_pfn_copy() fix + doc improvements (bsc#1241537).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38047: x86/fred: Fix system hang during S4 resume with FRED enabled (bsc#1245084).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
• CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
• CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
• CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
• CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
• CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
• CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
• CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
• CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
• CVE-2025-38106: io_uring/sqpoll: do not put task_struct on tctx setup failure (bsc#1245664).
• CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
• CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
• CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
• CVE-2025-38147:…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-11135: TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may (bsc#1139073)
• CVE-2024-36028: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() (bsc#1225707).
• CVE-2024-36348, CVE-2024-36349, CVE-2024-36350, CVE-2024-36357: x86/process: Move the buffer clearing before MONITOR (bsc#1238896).
• CVE-2024-44963: btrfs: do not BUG_ON() when freeing tree block after error (bsc#1230216).
• CVE-2024-56742: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() (bsc#1235613).
• CVE-2025-21839: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (bsc#1239061).
• CVE-2025-21872: efi/mokvar-table: Avoid repeated map/unmap of the same page (bsc#1240323).
• CVE-2025-23163: net: vlan: do not propagate flags on open (bsc#1242837).
• CVE-2025-37856: btrfs: harden block_group::bg_list against list_del() races (bsc#1243068).
• CVE-2025-37864: net: dsa: clean up FDB, MDB, VLAN entries on unbind (bsc#1242965).
• CVE-2025-37885: KVM: x86: Reset IRTE to host control if new route isn't postable (bsc#1242960).
• CVE-2025-37920: kABI workaround for xsk: Fix race condition in AF_XDP generic RX path (bsc#1243479).
• CVE-2025-37984: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() (bsc#1243669).
• CVE-2025-38034: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref (bsc#1244792).
• CVE-2025-38035: nvmet-tcp: do not restore null sk_state_change (bsc#1244801).
• CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent (bsc#1244750).
• CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock (bsc#1245151).
• CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write() (bsc#1245440).
• CVE-2025-38062: kABI: restore layout of struct msi_desc (bsc#1245216).
• CVE-2025-38063: dm: fix unconditional IO throttle caused by REQ_PREFLUSH (bsc#1245202).
• CVE-2025-38064: virtio: break and reset virtio devices on device_shutdown() (bsc#1245201).
• CVE-2025-38074: vhost-scsi: protect vq->log_used with vq->mutex (bsc#1244735).
• CVE-2025-38094: net: cadence: macb: Fix a possible deadlock in macb_halt_tx (bsc#1245649).
• CVE-2025-38097: kabi: restore encap_sk in struct xfrm_state (bsc#1245660).
• CVE-2025-38098: drm/amd/display: Do not treat wb connector as physical in (bsc#1245654).
• CVE-2025-38099: Bluetooth: btusb: Fix regression in the initialization of fake Bluetooth controllers (bsc#1245671).
• CVE-2025-38100: x86/iopl: Cure TIF_IO_BITMAP inconsistencies (bsc#1245650).
• CVE-2025-38105: ALSA: usb-audio: Kill timer properly at removal (bsc#1245682).
• CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling (bsc#1245689).
• CVE-2025-38117: hci_dev centralize extra lock (bsc#1245695).
• CVE-2025-38126: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping (bsc#1245708).
• CVE-2025-38131: coresight: prevent deactivate active config while enabling the config (bsc#1245677).
• CVE-2025-38132: coresight: holding cscfg_csdev_lock while removing cscfg from csdev (bsc#1245679).
• CVE-2025-38147: calipso: unlock rcu before returning -EAFNOSUPPORT (bsc#1245768).
• CVE-2025-38158: hisi_acc_vfio_pci: fix XQE dma address error (bsc#1245750).
• CVE-2025-38162: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (bsc#1245752).
• CVE-2025-38166: bpf: fix ktls panic with sockmap (bsc#1245758).
• CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling (bsc#1245970).
• CVE-2025-38182: ublk: santizize the arguments from userspace when adding a device (bsc#1245937).
• CVE-2025-38183: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() (bsc#1246006).
• CVE-2025-38187: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() (bsc#1245951).
• CVE-2025-38188:…

This update for the Linux Kernel 6.4.0-150600_10_8 fixes several issues.

The following security issues were fixed:

• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231862).
• CVE-2025-38177: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38109: net/mlx5: fix ECVF vports unload on shutdown flow (bsc#1245685).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-21756: vsock: Keep the binding until socket destruction (bsc#1245795).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1245795).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).
• CVE-2025-38555: usb: gadget : fix use-after-free in composite_dev_cleanup() (bsc#1248298).

This update for the Linux Kernel 6.4.0-150600_10_14 fixes several issues.

The following security issues were fixed:

• CVE-2025-38177: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38109: net/mlx5: fix ECVF vports unload on shutdown flow (bsc#1245685).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-21756: vsock: Keep the binding until socket destruction (bsc#1245795).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1245795).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).
• CVE-2025-38555: usb: gadget : fix use-after-free in composite_dev_cleanup() (bsc#1248298).

This update for the Linux Kernel 6.4.0-150700_5 fixes several issues.

The following security issues were fixed:

• CVE-2025-38177: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38109: net/mlx5: fix ECVF vports unload on shutdown flow (bsc#1245685).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).
• CVE-2025-38555: usb: gadget : fix use-after-free in composite_dev_cleanup() (bsc#1248298).

This update for the Linux Kernel 6.4.0-150700_7_3 fixes several issues.

The following security issues were fixed:

• CVE-2025-38109: net/mlx5: fix ECVF vports unload on shutdown flow (bsc#1245685).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).
• CVE-2025-38555: usb: gadget : fix use-after-free in composite_dev_cleanup() (bsc#1248298).

This update for the Linux Kernel 4.12.14-122_231 fixes several issues.

The following security issues were fixed:

• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231862).
• CVE-2025-38177: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).

This update for the Linux Kernel 4.12.14-122_234 fixes several issues.

The following security issues were fixed:

• CVE-2025-38177: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).

This update for the Linux Kernel 4.12.14-122_228 fixes several issues.

The following security issues were fixed:

• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231862).
• CVE-2025-38177: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).

This update for the Linux Kernel 4.12.14-122_261 fixes several issues.

The following security issues were fixed:

• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).

This update for the Linux Kernel 6.4.0-150600_10_5 fixes several issues.

The following security issues were fixed:

• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231862).
• CVE-2025-38177: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38109: net/mlx5: fix ECVF vports unload on shutdown flow (bsc#1245685).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-21756: vsock: Keep the binding until socket destruction (bsc#1245795).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1245795).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).
• CVE-2025-38555: usb: gadget : fix use-after-free in composite_dev_cleanup() (bsc#1248298).
• CVE-2024-26808: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1245772).

This update for the Linux Kernel 4.12.14-122_244 fixes several issues.

The following security issues were fixed:

• CVE-2025-38177: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).

This update for the Linux Kernel 6.4.0-150600_10_17 fixes several issues.

The following security issues were fixed:

• CVE-2025-38177: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38109: net/mlx5: fix ECVF vports unload on shutdown flow (bsc#1245685).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-21756: vsock: Keep the binding until socket destruction (bsc#1245795).
• CVE-2025-21755: vsock: Orphan socket after transport release (bsc#1245795).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).
• CVE-2025-38555: usb: gadget : fix use-after-free in composite_dev_cleanup() (bsc#1248298).

This update for the Linux Kernel 4.12.14-122_255 fixes several issues.

The following security issues were fixed:

• CVE-2025-38177: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38181: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-38498: do_change_type(): refuse to operate on unmounted/not ours mounts (bsc#1247499).