CVE-2025-40134

dm: fix NULL pointer dereference in __dm_suspend()

7.3 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

dm: fix NULL pointer dereference in __dm_suspend()

There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes:

BUG: kernel NULL pointer dereference, address: 0000000000000054 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50 Call Trace: <TASK> blk_mq_quiesce_queue+0x2c/0x50 dm_stop_queue+0xd/0x20 __dm_suspend+0x130/0x330 dm_suspend+0x11a/0x180 dev_suspend+0x27e/0x560 ctl_ioctl+0x4cf/0x850 dm_ctl_ioctl+0xd/0x20 vfs_ioctl+0x1d/0x50 __se_sys_ioctl+0x9b/0xc0 __x64_sys_ioctl+0x19/0x30 x64_sys_call+0x2c4a/0x4620 do_syscall_64+0x9e/0x1b0

The issue can be triggered as below:

T1 T2 dm_suspend table_load __dm_suspend dm_setup_md_queue dm_mq_init_request_queue blk_mq_init_allocated_queue => q->mq_ops = set->ops; (1) dm_stop_queue / dm_wait_for_completion => q->tag_set NULL pointer! (2) => q->tag_set = set; (3)

Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps.

Even when map is NULL, no I/O can reach any target because there is no table loaded; I/O submitted in this state will fail early in the DM layer. Skipping the table-dependent suspend logic in this case is safe and avoids NULL pointer dereferences.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: High

Exploit likelihood

0.23%Up 0.2 points since Nov 12, 2025

What each source reports

OSV Score usedOESA-2025-2765 7.3

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.(CVE-2025-22080)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-23150)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix OOB read when checking dotdot dir

Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when the corrupted directory is removed).

ext4_empty_dir() assumes every ext4 directory contains at least '.' and '..' as directory entries in the first data block. It first loads the '.' dir entry, performs sanity checks by calling ext4_check_dir_entry() and then uses its rec_len member to compute the location of '..' dir entry (in ext4_next_entry). It assumes the '..' dir entry fits into the same data block.

If the rec_len of '.' is precisely one block (4KB), it slips through the sanity checks (it is considered the last directory entry in the data block) and leaves "struct ext4_dir_entry_2 *de" point…

Record: OESA-2025-2765
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

OSV Score usedOESA-2025-2766 7.3

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

cdx: Fix possible UAF error in driver_override_show()

Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c

This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs.

The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users.

Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues.

This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations.(CVE-2025-21915)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour…

Record: OESA-2025-2766
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

OSV Score usedOESA-2025-2767 7.3

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-23150)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix OOB read when checking dotdot dir

Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when the corrupted directory is removed).

If the rec_len of '.' is precisely one block (4KB), it slips through the sanity checks (it is considered the last directory entry in the data block) and leaves "struct ext4_dir_entry_2 *de" point…

Record: OESA-2025-2767
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

CVE List No score

dm: fix NULL pointer dereference in __dm_suspend()

In the Linux kernel, the following vulnerability has been resolved:

dm: fix NULL pointer dereference in __dm_suspend()

There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes:

The issue can be triggered as below:

Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps.

Record: CVE-2025-40134
Updated: 2026-11-05

EUVDEUVD-2025-124949 No score

In the Linux kernel, the following vulnerability has been resolved:

dm: fix NULL pointer dereference in __dm_suspend()

There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes:

The issue can be triggered as below:

Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps.

Record: EUVD-2025-124949
Updated: 2026-11-05

GitHub AdvisoriesGHSA-m29g-8vpf-pc8m No score

In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer...

In the Linux kernel, the following vulnerability has been resolved:

dm: fix NULL pointer dereference in __dm_suspend()

There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes:

The issue can be triggered as below:

Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps.

Record: GHSA-m29g-8vpf-pc8m
Updated: 2026-11-02

Show 45 moreShow less

NVD No score

In the Linux kernel, the following vulnerability has been resolved:

dm: fix NULL pointer dereference in __dm_suspend()

There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes:

The issue can be triggered as below:

Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps.

Record: CVE-2025-40134
Updated: 2026-11-05

OSVRHSA-2026:18134 8.7

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:18134
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:18587 8.7

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:18587
CVSS 3.1: 8.7 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-02

OSVALSA-2026:18134 No score

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg (CVE-2024-56633)
kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839)
kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)
kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)
kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)
kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)
kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() (CVE-2025-38202)
kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)
kernel: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun (CVE-2025-38267)
kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug (CVE-2025-38275)
kernel: ftrace: Fix UAF when lookup kallsym after ftrace disabled (CVE-2025-38346)
kernel: ACPICA: fix acpi operand cache leak in dswstate.c (CVE-2025-38345)
kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)
kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)
kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)
kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)
kernel: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() (CVE-2025-40034)
kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)
kernel: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" (CVE-2025-40210)
kernel: Linux kernel MPTCP: Privilege escalation or denial of service via use-after-free in timer handling (CVE-2025-40257)
kernel: smb: client: fix potential cfid UAF in smb2_query_info_compound (CVE-2025-40320)
kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)
kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210)
kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record: ALSA-2026:18134
Updated: 2026-11-02

OSVALSA-2026:18587 No score

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: bonding: check xdp prog when set bond mode (CVE-2025-22105)
kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980)
kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015)
kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097)
kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166)
kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279)
kernel: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails (CVE-2025-38400)
kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405)
kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441)
kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470)
kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866)
kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134)
kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040)
kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

Record: ALSA-2026:18587
Updated: 2026-11-02

OSVCLSA-2025-1764085382 No score

kernel-uek: Fix of 236 CVEs

drm/amd/display: Skip on writeback when it's not applicable {CVE-2024-36914}
ASoC: topology: Fix references to freed memory {CVE-2024-41069}
Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
Bluetooth: SCO: Fix not validating setsockopt user input
drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
xfs: don't walk off the end of a directory data block {CVE-2024-41013}
wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
net/rds: Fix rs_recv_pending counting issue
LTS tag: v5.4.301
net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
media: s5p-mfc: remove an unused/uninitialized variable
NFSD: Fix last write offset handling in layoutcommit
NFSD: Minor cleanup in layoutcommit processing
padata: Reset next CPU when reorder sequence wraps around
KEYS: trusted_tpm1: Compare HMAC values in constant time
NFSD: Define a proc_layoutcommit for the FlexFiles layout type {CVE-2025-40087}
vfs: Don't leak disconnected dentries on umount {CVE-2025-40105}
jbd2: ensure that all ongoing I/O complete before freeing blocks
ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
drm/amdgpu: use atomic functions with memory barriers for vm fault info
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() {CVE-2025-40198}
spi: cadence-quadspi: Flush posted register writes before DAC access
spi: cadence-quadspi: Flush posted register writes before INDAC access
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
memory: samsung: exynos-srom: Correct alignment
arm64: errata: Apply workarounds for Neoverse-V3AE
arm64: cputype: Add Neoverse-V3AE definitions
comedi: fix divide-by-zero in comedi_buf_munge() {CVE-2025-40106}
binder: remove "invalid inc weak" check
xhci: dbc: enable back DbC in resume if it was enabled before suspend
usb/core/quirks: Add Huawei ME906S to wakeup quirk
USB: serial: option: add Telit FN920C04 ECM compositions
USB: serial: option: add Quectel RG255C
USB: serial: option: add UNISOC UIS7720
net: ravb: Ensure memory write completes before ringing TX doorbell
net: usb: rtl8150: Fix frame padding
ocfs2: clear extent cache after moving/defragmenting extents
MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
Revert "cpuidle: menu: Avoid discarding useful information"
net: bonding: fix possible peer notify event loss or dup issue
sctp: avoid NULL dereference when chunk data buffer is missing
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
net: enetc: correct the value of ENETC_RXB_TRUESIZE
rtnetlink: Allow deleting FDB entries in user namespace
net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
net: add ndo_fdb_del_bulk
net: rtnetlink: add bulk delete support flag
net: netlink: add NLM_F_BULK delete request modifier
net: rtnetlink: use BIT for flag values
net: rtnetlink: add helper to extract msg type's kind
net: rtnetlink: add msg kind names
net: rtnetlink: remove redundant assignment to variable err
m68k: bitops: Fix find_*_bit() signatures
hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
dlm: check for defined force value in dlm_lockspace_release
hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
hfs: validate record offset in hfsplus_bmap_alloc
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
hfs: make proper initalization of struct hfs_find_data
hfs: clear offset and space out of valid records in b-tree node
exec: Fix incorrect type for ret
hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() {CVE-2025-40088}
ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
sched/fair: Fix pelt lost idle time…

Record: CLSA-2025-1764085382
Updated: 2026-11-02

OSVCLSA-2026-1781344094 No score

kernel: Fix of 93 CVEs

irqchip: Fix refcount leak in platform_irqchip_probe {CVE-2023-53610}
IB/hfi1: Fix a memleak in init_credit_return {CVE-2024-26839}
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() {CVE-2026-23335}
wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() {CVE-2025-71100}
RDMA/core: always drop device refcount in ib_del_sub_device_and_put() {CVE-2025-71157}
drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table {CVE-2024-58052}
ionic: Fix netdev notifier unregister on failure {CVE-2024-56715}
uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind {CVE-2024-46739}
netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
usb: typec: altmodes/displayport: do not index invalid pin_assignments {CVE-2025-38391}
crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init {CVE-2023-52616}
eventpoll: defer struct eventpoll free to RCU grace period {CVE-2026-43074}
wifi: brcmsmac: Fix dma_free_coherent() size {CVE-2026-31661}
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120}
netfilter: nf_conntrack_expect: skip expectations in other netns via proc {CVE-2026-31496}
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data {CVE-2026-23370}
crypto: bcm - add error check in the ahash_hmac_init function {CVE-2024-56681}
nvme-pci: ensure we're polling a polled queue {CVE-2026-31523}
mmc: vub300: fix NULL-deref on disconnect {CVE-2026-31651}
kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() {CVE-2023-52936}
ipmi: ipmb: Add check devm_kasprintf() returned value {CVE-2024-58051}
net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
ASoC: amd: fix memory leak in acp3x pdm dma ops {CVE-2026-23190}
udp: Deal with race between UDP socket address change and rehash {CVE-2024-57974}
team: avoid NETDEV_CHANGEMTU event when unregistering slave {CVE-2026-43234}
tcp: secure_seq: add back ports to TS offset {CVE-2026-23247}
udp: Fix wildcard bind conflict check when using hash2 {CVE-2026-31503}
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation {CVE-2025-38162}
rxrpc: Fix recv-recv race of completed call {CVE-2025-38524}
netfilter: nf_tables: reject duplicate device on updates {CVE-2025-38678}
nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
crypto: af_alg - limit RX SG extraction by receive buffer budget {CVE-2026-31677}
xfrm: account XFRMA_IF_ID in aevent size calculation {CVE-2026-43107}
KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop {CVE-2025-21839}
perf: Fix sample vs do_exit() {CVE-2025-38424}
netfilter: nf_tables: avoid chain re-validation if possible {CVE-2025-71160}
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item {CVE-2025-68211}
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime {CVE-2025-38470}
net: add proper RCU protection to /proc/net/ptype {CVE-2026-23255}
ALSA: ctxfi: Check the error for index mapping {CVE-2026-31777}
rseq: Fix segfault on registration when rseq_cs is non-zero {CVE-2025-38067}
RDMA/core: Don't expose hw_counters outside of init net namespace {CVE-2025-22089}
net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv {CVE-2026-22996}
Input: synaptics - fix crash when enabling pass-through port {CVE-2025-21746}
wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579}
ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() {CVE-2025-38305}
driver core: fix potential NULL pointer dereference in dev_uevent() {CVE-2025-37800}
dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
net: let net.core.dev_weight always be non-zero {CVE-2025-21806}
exec:…

Record: CLSA-2026-1781344094
Updated: 2026-11-02

OSVCLSA-2026-1783355084 No score

kernel: Fix of 60 CVEs

net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
unshare: fix unshare_fs() handling {CVE-2026-43472}
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() {CVE-2026-31423}
net/sched: cls_flow: fix NULL pointer dereference on shared blocks {CVE-2026-31422}
net/sched: cls_fw: fix NULL pointer dereference on shared blocks {CVE-2026-31421}
dm: fix queue start/stop imbalance under suspend/load/resume races {CVE-2025-40134}
ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() {CVE-2024-26773}
ext4: fix i_data_sem unlock order in ext4_ind_migrate() {CVE-2024-50006}
xen: Fix the issue of resource not being properly released in xenbus_dev_probe() {CVE-2024-53198}
HID: pidff: Fix null pointer dereference in pidff_find_fields {CVE-2025-37862}
crypto: af_alg - Set merge to zero early in af_alg_sendmsg {CVE-2025-39931}
x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper {CVE-2025-39681}
can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23061}
bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change {CVE-2023-53103}
NFS: Fix a potential data corruption {CVE-2023-53711}
NFS: Fix a use after free in nfs_direct_join_group() {CVE-2023-53711}
hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47386}
scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload {CVE-2024-36919}
x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type {CVE-2023-52659}
Input: uinput - reject requests with unreasonable number of slots {CVE-2024-46745}
afs: Fix the maximum cell name length {CVE-2025-21646}
drm/i915: Avoid potential vm use-after-free {CVE-2023-52931}
interconnect: fix mem leak when freeing nodes {CVE-2023-53096}
drm/vkms: Fix memory leak in vkms_init() {CVE-2022-50269}
USB: dwc3: fix memory leak with using debugfs_lookup() {CVE-2023-53415}
mm/uffd: fix pte marker when fork() without fork event {CVE-2022-49744}
scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() {CVE-2023-53696}
ipmi_si: fix a memleak in try_smi_init() {CVE-2023-53611}
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() {CVE-2024-58083}
scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() {CVE-2024-36924}
firmware: cs_dsp: Validate payload length before processing block {CVE-2024-42237}
hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47385}
ftrace: Avoid potential division by zero in function_stat_show() {CVE-2025-21898}
IB/core: Implement a limit on UMAD receive List {CVE-2024-42145}
vfio/pci: Disable auto-enable of exclusive INTx IRQ {CVE-2024-27437}
netfilter: nf_tables: reject duplicate device on updates {CVE-2025-38678}
PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type {CVE-2025-23161}
net: nexthop: Initialize all fields in dumped nexthops {CVE-2024-42283}
tracing: Make sure trace_printk() can output as soon as it can be used {CVE-2023-53007}
net: tls: explicitly disallow disconnect {CVE-2025-37756}
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel {CVE-2025-21779}
ext4: turn quotas off if mount failed after enabling quotas {CVE-2023-54153}
NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622}
block: fix overflow in blk_ioctl_discard() {CVE-2024-36917}
usb: xhci: Check endpoint is valid before dereferencing it {CVE-2023-52901}
iio: core: fix memleak in iio_device_register_sysfs {CVE-2023-52643}
platform/x86/amd/pmc: Detect when STB is not available {CVE-2024-53072}
mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() {CVE-2023-52939}
dm thin: make get_first_thin use rcu-safe list first function {CVE-2025-21664}
bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock {CVE-2025-21951}
bonding: provide a net pointer to…

Record: CLSA-2026-1783355084
Updated: 2026-11-02

OSVCLSA-2026-1783362244 No score

kernel: Fix of 122 CVEs

KVM: x86: Fix shadow paging use-after-free due to unexpected role {CVE-2026-46113}
KVM: x86: Fix shadow paging use-after-free due to unexpected GFN {CVE-2026-46113}
Bluetooth: bcsp: receive data only if registered {CVE-2025-40308}
xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts {CVE-2026-43429}
net: usb: rtl8150: enable basic endpoint checking {CVE-2025-21708}
net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
net: usb: pegasus: validate USB endpoints {CVE-2026-23290}
net: usb: pegasus: enable basic endpoint checking {CVE-2026-43156}
USB: usbcore: Introduce usb_bulk_msg_killable() {CVE-2026-43429}
USB: core: Add routines for endpoint checks in old drivers {CVE-2026-43156}
nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
tpm: Cap the number of PCR banks {CVE-2025-71077}
clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() {CVE-2023-53704}
dm: fix a race condition in retrieve_deps {CVE-2023-54324}
ice: fix Tx scheduler error handling in XDP callback {CVE-2025-38127}
mlx5: fix skb leak while fifo resync and push {CVE-2023-54238}
mmc: vub300: fix return value check of mmc_add_host() {CVE-2022-50251}
bonding: annotate data-races around slave->last_rx {CVE-2026-23212}
RDMA/irdma: Fix data race on CQP completion stats {CVE-2023-54302}
bpf: cpumap: Fix memory leak in cpu_map_update_elem {CVE-2023-53441}
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38215}
trace/fgraph: Fix the warning caused by missing unregister notifier {CVE-2025-39829}
vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
team: prevent adding a device which is already a team device lower {CVE-2024-58071}
net: stmmac: move the EST lock to struct stmmac_priv {CVE-2024-38594}
drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too {CVE-2024-50108}
rxrpc: Fix handling of received connection abort {CVE-2024-58053}
bnxt_en: Fix out-of-bound memcpy() during ethtool -w {CVE-2025-37911}
scsi: storvsc: Ratelimit warning logs to prevent VM denial of service {CVE-2025-21690}
net: atlantic: Fix DMA mapping for PTP hwts ring {CVE-2024-26680}
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() {CVE-2024-47713}
drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2) {CVE-2024-49905}
dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
smb: client: validate the whole DACL before rewriting it in cifsacl {CVE-2026-31709}
PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
cachefiles: fix dentry leak in cachefiles_open_file() {CVE-2024-49870}
mm: revert "mm: shmem: fix data-race in shmem_getattr()" {CVE-2024-53136}
memcg: fix soft lockup in the OOM process {CVE-2024-57977}
resource: fix region_intersects() vs add_memory_driver_managed() {CVE-2024-49878}
r8169: add tally counter fields added with RTL8125 {CVE-2024-49973}
svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() {CVE-2024-53215}
ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths {CVE-2026-43066}
wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() {CVE-2025-71273}
net: netlink: af_netlink: Prevent empty skb by adding a check on len. {CVE-2021-47606}
extcon: Modify extcon device to be created after driver data is set {CVE-2022-49308}
tick/nohz: unexport __init-annotated tick_nohz_full_setup() {CVE-2022-49675}
bridge:…

Record: CLSA-2026-1783362244
Updated: 2026-11-02

OSV No score

dm: fix NULL pointer dereference in __dm_suspend()

In the Linux kernel, the following vulnerability has been resolved:

dm: fix NULL pointer dereference in __dm_suspend()

There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes:

The issue can be triggered as below:

Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps.

Record: CVE-2025-40134
Updated: 2026-11-07

OSVDEBIAN-CVE-2025-40134 No score

In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend is invoked before table load completes: BUG: kernel NULL pointer dereference, address: 0000000000000054 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 6798 Comm: dmsetup Not tainted 6.6.0-g7e52f5f0ca9b #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:blk_mq_wait_quiesce_done+0x0/0x50 Call Trace: <TASK> blk_mq_quiesce_queue+0x2c/0x50 dm_stop_queue+0xd/0x20 __dm_suspend+0x130/0x330 dm_suspend+0x11a/0x180 dev_suspend+0x27e/0x560 ctl_ioctl+0x4cf/0x850 dm_ctl_ioctl+0xd/0x20 vfs_ioctl+0x1d/0x50 __se_sys_ioctl+0x9b/0xc0 __x64_sys_ioctl+0x19/0x30 x64_sys_call+0x2c4a/0x4620 do_syscall_64+0x9e/0x1b0 The issue can be triggered as below: T1 T2 dm_suspend table_load __dm_suspend dm_setup_md_queue dm_mq_init_request_queue blk_mq_init_allocated_queue => q->mq_ops = set->ops; (1) dm_stop_queue / dm_wait_for_completion => q->tag_set NULL pointer! (2) => q->tag_set = set; (3) Fix this by checking if a valid table (map) exists before performing request-based suspend and waiting for target I/O. When map is NULL, skip these table-dependent suspend steps. Even when map is NULL, no I/O can reach any target because there is no table loaded; I/O submitted in this state will fail early in the DM layer. Skipping the table-dependent suspend logic in this case is safe and avoids NULL pointer dereferences.

Record: DEBIAN-CVE-2025-40134
Updated: 2026-11-06

OSVopenSUSE-SU-2025:20172-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
CVE-2025-40134: dm: fix NULL pointer dereference in…

Record: openSUSE-SU-2025:20172-1
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2025-40134 No score

CVE-2025-40134 in linux - Patched by Root

Root has patched CVE-2025-40134 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2025-40134
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-13-CVE-2025-40134 No score

CVE-2025-40134 in linux - Patched by Root

Root has patched CVE-2025-40134 in the linux package for Root:Debian:13. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-13-CVE-2025-40134
Updated: 2026-11-03

OSVROOT-OS-UBUNTU-2404-CVE-2025-40134 No score

CVE-2025-40134 in linux - Patched by Root

Root has patched CVE-2025-40134 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-40134
Updated: 2026-11-06

OSVSUSE-SU-2026:0278-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

Record: SUSE-SU-2026:0278-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0281-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

Record: SUSE-SU-2026:0281-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0293-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).

The following non security issues were fixed:

ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes).
ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes).
ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes).
ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes).
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes).
ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes).
ALSA: uapi: Fix typo in asound.h comment (git-fixes).
ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes).
ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes).
ASoC: ak4458: Disable regulator when error happens (git-fixes).
ASoC: ak5558: Disable regulator when error happens (git-fixes).
ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes).
ASoC: fsl_xcvr: clear the channel status control memory (git-fixes).
ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes).
ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes).
ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment…

Record: SUSE-SU-2026:0293-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0315-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

Record: SUSE-SU-2026:0315-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20012-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
CVE-2025-40134: dm: fix NULL pointer dereference in…

Record: SUSE-SU-2026:20012-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20015-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
CVE-2025-40134: dm: fix NULL pointer dereference in…

Record: SUSE-SU-2026:20015-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20021-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
CVE-2025-40134: dm: fix NULL pointer dereference in…

Record: SUSE-SU-2026:20021-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20477-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in…

Record: SUSE-SU-2026:20477-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20498-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in…

Record: SUSE-SU-2026:20498-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20562-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
CVE-2025-40134: dm: fix NULL pointer dereference in…

Record: SUSE-SU-2026:20562-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20845-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Record: SUSE-SU-2026:20845-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20876-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Record: SUSE-SU-2026:20876-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-40134 No score

Record: UBUNTU-CVE-2025-40134
Updated: 2026-11-06

OSVUSN-8029-1 No score

linux, linux-raspi, linux-realtime vulnerabilities