CVE-2025-40123

In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expected_attach_type for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. This leads to a NULL pointer dereference when a BPF program attempts to deference the txq member of struct xdp_buff object. The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the entry point for bpf_prog_test_run_xdp() and its expected_attach_type can neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP to pass xdp_is_valid_access() validation. The program returns struct xdp_md's egress_ifindex, and the latter is only allowed to be accessed under mentioned expected_attach_type. progB is then inserted into the tailcall which progA calls. The underlying issue goes beyond XDP though. Another example are programs of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well as sock_addr_func_proto() have different logic depending on the programs' expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME should not be allowed doing a tailcall into a program which calls bpf_bind() out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. In short, specifying expected_attach_type allows to open up additional functionality or restrictions beyond what the basic bpf_prog_type enables. The use of tailcalls must not violate these constraints. Fix it by enforcing expected_attach_type in __bpf_prog_map_compatible(). Note that we only enforce this for tailcall maps, but not for BPF devmaps or cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and cpu_map_bpf_prog_run*() which set up a new environment / context and therefore these situations are not prone to this issue.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_transThere is a kernel API ntb_mw_clear_trans() would pass 0 to both addr andsize. This would make xlate_pos negative.[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000[ 23.734158] ================================================================================[ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7[ 23.734418] shift exponent -1 is negativeEnsuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)

In the Linux kernel, the following vulnerability has been resolved:slimbus: messaging: Free transaction ID in delayed interrupt scenarioIn case of interrupt delay for any reason, slim_do_transfer()returns timeout error but the transaction ID (TID) is not freed.This results into invalid memory access insideqcom_slim_ngd_rx_msgq_cb() due to invalid TID.Fix the issue by freeing the TID in slim_do_transfer() beforereturning timeout error to avoid invalid memory access.Call trace:__memcpy_fromio+0x20/0x190qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl]vchan_complete+0x2a0/0x4a0tasklet_action_common+0x274/0x700tasklet_action+0x28/0x3c_stext+0x188/0x620run_ksoftirqd+0x34/0x74smpboot_thread_fn+0x1d8/0x464kthread+0x178/0x238ret_from_fork+0x10/0x20Code: aa0003e8 91000429 f100044a 3940002b (3800150b)---[ end trace 0fe00bec2b975c99 ]---Kernel panic - not syncing: Oops: Fatal exception in interrupt.(CVE-2025-21914)

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: check that event count does not exceed event buffer length

The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event buffer length. Check that event count does not exceed event buffer length, avoiding an out-of-bounds access when memcpy'ing the event. Crash log: Unable to handle kernel paging request at virtual address ffffffc0129be000 pc : __memcpy+0x114/0x180 lr : dwc3_check_event_buf+0xec/0x348 x3 : 0000000000000030 x2 : 000000000000dfc4 x1 : ffffffc0129be000 x0 : ffffff87aad60080 Call trace: __memcpy+0x114/0x180 dwc3_interrupt+0x24/0x34(CVE-2025-37810)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Validate UAC3 cluster segment descriptors

UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.(CVE-2025-39757)

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()

During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device.

Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal.

[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP: 0018:ff85aeafc3137bb0…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_transThere is a kernel API ntb_mw_clear_trans() would pass 0 to both addr andsize. This would make xlate_pos negative.[ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000[ 23.734158] ================================================================================[ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7[ 23.734418] shift exponent -1 is negativeEnsuring xlate_pos is a positive or zero before BIT.(CVE-2023-53034)

In the Linux kernel, the following vulnerability has been resolved:slimbus: messaging: Free transaction ID in delayed interrupt scenarioIn case of interrupt delay for any reason, slim_do_transfer()returns timeout error but the transaction ID (TID) is not freed.This results into invalid memory access insideqcom_slim_ngd_rx_msgq_cb() due to invalid TID.Fix the issue by freeing the TID in slim_do_transfer() beforereturning timeout error to avoid invalid memory access.Call trace:__memcpy_fromio+0x20/0x190qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl]vchan_complete+0x2a0/0x4a0tasklet_action_common+0x274/0x700tasklet_action+0x28/0x3c_stext+0x188/0x620run_ksoftirqd+0x34/0x74smpboot_thread_fn+0x1d8/0x464kthread+0x178/0x238ret_from_fork+0x10/0x20Code: aa0003e8 91000429 f100044a 3940002b (3800150b)---[ end trace 0fe00bec2b975c99 ]---Kernel panic - not syncing: Oops: Fatal exception in interrupt.(CVE-2025-21914)

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: gadget: check that event count does not exceed event buffer length

The event count is read from register DWC3_GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event buffer length. Check that event count does not exceed event buffer length, avoiding an out-of-bounds access when memcpy'ing the event. Crash log: Unable to handle kernel paging request at virtual address ffffffc0129be000 pc : __memcpy+0x114/0x180 lr : dwc3_check_event_buf+0xec/0x348 x3 : 0000000000000030 x2 : 000000000000dfc4 x1 : ffffffc0129be000 x0 : ffffff87aad60080 Call trace: __memcpy+0x114/0x180 dwc3_interrupt+0x24/0x34(CVE-2025-37810)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Validate UAC3 cluster segment descriptors

UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.(CVE-2025-39757)

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()

During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this point the SAS transport device may already be partially unregistered or freed, leading to a crash when accessing its struct device.

Using ioc_info(), which logs via the PCI device (ioc->pdev->dev), guaranteed to remain valid until driver removal.

[83428.295776] Oops: general protection fault, probably for non-canonical address 0x6f702f323a33312d: 0000 [#1] SMP NOPTI [83428.295785] CPU: 145 UID: 0 PID: 113296 Comm: rmmod Kdump: loaded Tainted: G OE 6.16.0-rc1+ #1 PREEMPT(voluntary) [83428.295792] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [83428.295795] Hardware name: Dell Inc. Precision 7875 Tower/, BIOS 89.1.67 02/23/2024 [83428.295799] RIP: 0010:__dev_printk+0x1f/0x70 [83428.295805] Code: 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 49 89 d1 48 85 f6 74 52 4c 8b 46 50 4d 85 c0 74 1f 48 8b 46 68 48 85 c0 74 22 <48> 8b 08 0f b6 7f 01 48 c7 c2 db e8 42 ad 83 ef 30 e9 7b f8 ff ff [83428.295813] RSP: 0018:ff85aeafc3137bb0…

The Linux Kernel, the operating system core itself.

Security Fix(es):

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.(CVE-2025-22080)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-23150)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix OOB read when checking dotdot dir

Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when the corrupted directory is removed).

ext4_empty_dir() assumes every ext4 directory contains at least '.' and '..' as directory entries in the first data block. It first loads the '.' dir entry, performs sanity checks by calling ext4_check_dir_entry() and then uses its rec_len member to compute the location of '..' dir entry (in ext4_next_entry). It assumes the '..' dir entry fits into the same data block.

If the rec_len of '.' is precisely one block (4KB), it slips through the sanity checks (it is considered the last directory entry in the data block) and leaves "struct ext4_dir_entry_2 *de" point…

The Linux Kernel, the operating system core itself.

Security Fix(es):

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

In the Linux kernel, the following vulnerability has been resolved:

cdx: Fix possible UAF error in driver_override_show()

Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c

This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs.

The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users.

Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues.

This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations.(CVE-2025-21915)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.(CVE-2025-22080)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour…

The Linux Kernel, the operating system core itself.

Security Fix(es):

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.(CVE-2025-22080)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-23150)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix OOB read when checking dotdot dir

Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when the corrupted directory is removed).

ext4_empty_dir() assumes every ext4 directory contains at least '.' and '..' as directory entries in the first data block. It first loads the '.' dir entry, performs sanity checks by calling ext4_check_dir_entry() and then uses its rec_len member to compute the location of '..' dir entry (in ext4_next_entry). It assumes the '..' dir entry fits into the same data block.

If the rec_len of '.' is precisely one block (4KB), it slips through the sanity checks (it is considered the last directory entry in the data block) and leaves "struct ext4_dir_entry_2 *de" point…

In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expected_attach_type for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpf_prog_test_run_xdp() function within the Linux kernel's BPF subsystem. This leads to a NULL pointer dereference when a BPF program attempts to deference the txq member of struct xdp_buff object. The test initializes two programs of BPF_PROG_TYPE_XDP: progA acts as the entry point for bpf_prog_test_run_xdp() and its expected_attach_type can neither be of be BPF_XDP_DEVMAP nor BPF_XDP_CPUMAP. progA calls into a slot of a tailcall map it owns. progB's expected_attach_type must be BPF_XDP_DEVMAP to pass xdp_is_valid_access() validation. The program returns struct xdp_md's egress_ifindex, and the latter is only allowed to be accessed under mentioned expected_attach_type. progB is then inserted into the tailcall which progA calls. The underlying issue goes beyond XDP though. Another example are programs of type BPF_PROG_TYPE_CGROUP_SOCK_ADDR. sock_addr_is_valid_access() as well as sock_addr_func_proto() have different logic depending on the programs' expected_attach_type. Similarly, a program attached to BPF_CGROUP_INET4_GETPEERNAME should not be allowed doing a tailcall into a program which calls bpf_bind() out of BPF which is only enabled for BPF_CGROUP_INET4_CONNECT. In short, specifying expected_attach_type allows to open up additional functionality or restrictions beyond what the basic bpf_prog_type enables. The use of tailcalls must not violate these constraints. Fix it by enforcing expected_attach_type in __bpf_prog_map_compatible(). Note that we only enforce this for tailcall maps, but not for BPF devmaps or cpumaps: There, the programs are invoked through dev_map_bpf_prog_run*() and cpu_map_bpf_prog_run*() which set up a new environment / context and therefore these situations are not prone to this issue.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
• CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
• CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
• CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
• CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
• CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
• CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
• CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40330: bnxt_en: Shutdown FW…

Root has patched CVE-2025-40123 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-40123 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-40123 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
• CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
• CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
• CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
• CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
• CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
• CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
• CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
• CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
• CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
• CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
• CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
• CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
• CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
• CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
• CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
• CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
• CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
• CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-49604,CVE-2025-40074: ip: Fix data-races around sysctl_ip_fwd_use_pmtu (bsc#1238414 bsc#1252794).
• CVE-2022-50527: drm/amdgpu: Fix size validation for non-exclusive domains (v4) (bsc#1251738).
• CVE-2022-50625: serial: amba-pl011: avoid SBSA UART accessing DMACR register (bsc#1254559).
• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50656: nfc: pn533: Clear nfc_target before being used (bsc#1254745).
• CVE-2022-50678: wifi: brcmfmac: fix invalid address access when enabling SCAN log level (bsc#1254902).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53454: HID: multitouch: Correct devm device reference for hidinput input_dev name (bsc#1250759).
• CVE-2023-53718: ring-buffer: Do not swap cpu_buffer during resize process (bsc#1252564).
• CVE-2023-53748: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup (bsc#1254907).
• CVE-2023-53765: dm cache: free background tracker's queued work in btracker_destroy (bsc#1254912).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2023-53788: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (bsc#1254917).
• CVE-2023-53819: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va (bsc#1254712).
• CVE-2023-53850: iavf: use internal state to free traffic IRQs (bsc#1254677).
• CVE-2023-54120: Bluetooth: Fix race condition in hidp_session_thread (bsc#1256133).
• CVE-2023-54214: Bluetooth: L2CAP: Fix potential user-after-free (bsc#1255954).
• CVE-2023-54236: net/net_failover: fix txq exceeding warning (bsc#1255922).
• CVE-2023-54286: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (bsc#1255803).
• CVE-2023-54300: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (bsc#1255790).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
• CVE-2025-38336: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (bsc#1246370).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40035: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (bsc#1252866).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40110: drm/vmwgfx: Fix a null-ptr access in the cursor snooper (bsc#1253275).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40164: usbnet: Fix using smp_processor_id() in preemptible code warnings (bsc#1253407).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40198: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (bsc#1253453). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
• CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
• CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
• CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
• CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
• CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
• CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
• CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40330: bnxt_en: Shutdown FW…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
• CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
• CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
• CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
• CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
• CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
• CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
• CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40330: bnxt_en: Shutdown FW…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
• CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
• CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
• CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
• CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
• CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
• CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
• CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40330: bnxt_en: Shutdown FW…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
• CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
• CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
• CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
• CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
• CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
• CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
• CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
• CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
• CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
• CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40330: bnxt_en: Shutdown FW…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Device frequency scaling framework;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• Hardware monitoring drivers;
• HW tracing;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• PCI Endpoint Test driver;
• VMware Balloon Driver;
• MOST (Media Oriented Systems Transport) drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Mellanox platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Mellanox drivers;
• Memory management;
• Virtio network driver;
• Bluetooth subsystem;
• IP tunnels definitions;
• io_uring subsystem;
• Kernel crash support code;
• Perf events;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Network traffic control;
• SCTP protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• VMware vSockets driver;
• eXpress Data Path;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• ALSA framework;
• HD-audio driver;
• AMD SoC Alsa drivers;
• WCD audio codecs;
• Intel ASoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Device frequency scaling framework;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• Hardware monitoring drivers;
• HW tracing;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• PCI Endpoint Test driver;
• VMware Balloon Driver;
• MOST (Media Oriented Systems Transport) drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Mellanox platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Mellanox drivers;
• Memory management;
• Virtio network driver;
• Bluetooth subsystem;
• IP tunnels definitions;
• io_uring subsystem;
• Kernel crash support code;
• Perf events;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Network traffic control;
• SCTP protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• VMware vSockets driver;
• eXpress Data Path;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• ALSA framework;
• HD-audio driver;
• AMD SoC Alsa drivers;
• WCD audio codecs;
• Intel ASoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Device frequency scaling framework;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• Hardware monitoring drivers;
• HW tracing;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• PCI Endpoint Test driver;
• VMware Balloon Driver;
• MOST (Media Oriented Systems Transport) drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Mellanox platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Mellanox drivers;
• Memory management;
• Virtio network driver;
• Bluetooth subsystem;
• IP tunnels definitions;
• io_uring subsystem;
• Kernel crash support code;
• Perf events;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Network traffic control;
• SCTP protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• VMware vSockets driver;
• eXpress Data Path;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• ALSA framework;
• HD-audio driver;
• AMD SoC Alsa drivers;
• WCD audio codecs;
• Intel ASoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Device frequency scaling framework;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• Hardware monitoring drivers;
• HW tracing;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• PCI Endpoint Test driver;
• VMware Balloon Driver;
• MOST (Media Oriented Systems Transport) drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Mellanox platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Mellanox drivers;
• Memory management;
• Virtio network driver;
• Bluetooth subsystem;
• IP tunnels definitions;
• io_uring subsystem;
• Kernel crash support code;
• Perf events;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Network traffic control;
• SCTP protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• VMware vSockets driver;
• eXpress Data Path;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• ALSA framework;
• HD-audio driver;
• AMD SoC Alsa drivers;
• WCD audio codecs;
• Intel ASoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Device frequency scaling framework;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• Hardware monitoring drivers;
• HW tracing;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• PCI Endpoint Test driver;
• VMware Balloon Driver;
• MOST (Media Oriented Systems Transport) drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Mellanox platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Mellanox drivers;
• Memory management;
• Virtio network driver;
• Bluetooth subsystem;
• IP tunnels definitions;
• io_uring subsystem;
• Kernel crash support code;
• Perf events;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Network traffic control;
• SCTP protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• VMware vSockets driver;
• eXpress Data Path;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• ALSA framework;
• HD-audio driver;
• AMD SoC Alsa drivers;
• WCD audio codecs;
• Intel ASoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40041, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation; …

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

It was discovered that improper initialization of CPU cache memory could allow a local attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity. (CVE-2024-36331)

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to expose sensitive information. (CVE-2024-36350, CVE-2024-36357)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• ATA over ethernet (AOE) driver;
• DRBD Distributed Replicated Block Device drivers;
• Block device driver;
• Network block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• Mailbox framework;
• MCB driver;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Fastrpc Driver;
• Microchip PCI driver;
• Intel Management Engine Interface driver;
• PCI Endpoint Test driver;
• TI TPS6594 PFSM driver;
• VMware VMCI Driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Amlogic Meson DDR PMU;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• Power supply drivers;
• Powercap sysfs driver;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• QCOM SoC drivers;
• Samsung SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem; -…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem; -…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• Xen hypervisor drivers;
• AFS file system;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system; …

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• SMB network file system;
• SquashFS file system;
• UBI file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• IPv4 networking;
• Internal shared memory driver;
• Networking core;
• Scheduler infrastructure;
• Sun RPC protocol;
• Virtio network driver;
• Amateur Radio drivers;
• IP tunnels definitions;
• Network…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• User-space API (UAPI);
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Speakup Console Speech Driver;
• ACPI drivers;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Bluetooth drivers;
• Cdrom driver;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DAX dirext access to differentiated memory framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• Intel Trace Hub HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Generic PM domains;
• System reset/shutdown drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• Reset controller framework;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Media Oriented Systems Transport (MOST) driver;
• NVIDIA Tegra embedded controller (NVEC)…