CVE-2025-40153

mm: hugetlb: avoid soft lockup when mprotect to large memory area

6.8 MediumFix available

What does this mean?

: 6.8v4.0, from OSV
: 0.21%11th percentile
Fixed in: 6.1.156-r0linux-lts
Published: November 12, 2025
Modified: November 6, 2026
Also known as: BELL-CVE-2025-40153CLSA-2025-1764085382CLSA-2026-1787307395CLSA-2026-1791800936DEBIAN-CVE-2025-40153DLA-4379-1DLA-4404-1EUVD-2025-124930
Show 51 moreShow less
GHSA-vxqq-p97q-mvpjOESA-2025-2765OESA-2025-2766OESA-2025-2767ROOT-OS-DEBIAN-11-CVE-2025-40153ROOT-OS-DEBIAN-13-CVE-2025-40153ROOT-OS-UBUNTU-2404-CVE-2025-40153SUSE-SU-2026:0278-1SUSE-SU-2026:0281-1SUSE-SU-2026:0293-1SUSE-SU-2026:0315-1SUSE-SU-2026:0316-1SUSE-SU-2026:20012-1SUSE-SU-2026:20015-1SUSE-SU-2026:20021-1SUSE-SU-2026:20477-1SUSE-SU-2026:20498-1SUSE-SU-2026:20562-1SUSE-SU-2026:20845-1SUSE-SU-2026:20876-1UBUNTU-CVE-2025-40153USN-8029-1USN-8029-2USN-8029-3USN-8030-1USN-8033-1USN-8033-2USN-8033-3USN-8033-4USN-8033-5USN-8033-6USN-8033-7USN-8033-8USN-8034-1USN-8034-2USN-8048-1USN-8095-1USN-8095-2USN-8095-3USN-8095-4USN-8095-5USN-8100-1USN-8125-1USN-8126-1USN-8141-1USN-8163-1USN-8163-2USN-8165-1USN-8243-1USN-8261-1openSUSE-SU-2025:20172-1

In the Linux kernel, the following vulnerability has been resolved:

mm: hugetlb: avoid soft lockup when mprotect to large memory area

When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed:

watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916]

CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7 Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025 pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mte_clear_page_tags+0x14/0x24 lr : mte_sync_tags+0x1c0/0x240 sp : ffff80003150bb80 x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000 x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458 x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000 x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000 x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000

Call trace: mte_clear_page_tags+0x14/0x24 set_huge_pte_at+0x25c/0x280 hugetlb_change_protection+0x220/0x430 change_protection+0x5c/0x8c mprotect_fixup+0x10c/0x294 do_mprotect_pkey.constprop.0+0x2e0/0x3d4 __arm64_sys_mprotect+0x24/0x44 invoke_syscall+0x50/0x160 el0_svc_common+0x48/0x144 do_el0_svc+0x30/0xe0 el0_svc+0x30/0xf0 el0t_64_sync_handler+0xc4/0x148 el0t_64_sync+0x1a4/0x1a8

Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size.

Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too.

So add cond_resched() for hugetlb to avoid soft lockup.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.21%Up 0.2 points since Nov 12, 2025

What each source reports

OSV Score usedUBUNTU-CVE-2025-40153 6.8

In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed: watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916] CPU: 98 PID: 126916 Comm: t2_new_sysv Kdump: loaded Not tainted 6.17-rc7 Hardware name: GIGACOMPUTING R2A3-T40-AAV1/Jefferson CIO, BIOS 5.4.4.1 07/15/2025 pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mte_clear_page_tags+0x14/0x24 lr : mte_sync_tags+0x1c0/0x240 sp : ffff80003150bb80 x29: ffff80003150bb80 x28: ffff00739e9705a8 x27: 0000ffd2d6a00000 x26: 0000ff8e4bc00000 x25: 00e80046cde00f45 x24: 0000000000022458 x23: 0000000000000000 x22: 0000000000000004 x21: 000000011b380000 x20: ffff000000000000 x19: 000000011b379f40 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc875e0aa5e2c x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : fffffc01ce7a5c00 x4 : 00000000046cde00 x3 : fffffc0000000000 x2 : 0000000000000004 x1 : 0000000000000040 x0 : ffff0046cde7c000 Call trace: mte_clear_page_tags+0x14/0x24 set_huge_pte_at+0x25c/0x280 hugetlb_change_protection+0x220/0x430 change_protection+0x5c/0x8c mprotect_fixup+0x10c/0x294 do_mprotect_pkey.constprop.0+0x2e0/0x3d4 __arm64_sys_mprotect+0x24/0x44 invoke_syscall+0x50/0x160 el0_svc_common+0x48/0x144 do_el0_svc+0x30/0xe0 el0_svc+0x30/0xf0 el0t_64_sync_handler+0xc4/0x148 el0t_64_sync+0x1a4/0x1a8 Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size. Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too. So add cond_resched() for hugetlb to avoid soft lockup.

Record: UBUNTU-CVE-2025-40153
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-06

CVE List No score

mm: hugetlb: avoid soft lockup when mprotect to large memory area

In the Linux kernel, the following vulnerability has been resolved:

mm: hugetlb: avoid soft lockup when mprotect to large memory area

When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed:

watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916]

Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size.

Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too.

So add cond_resched() for hugetlb to avoid soft lockup.

Record: CVE-2025-40153
Updated: 2026-11-02

EUVDEUVD-2025-124930 No score

In the Linux kernel, the following vulnerability has been resolved:

mm: hugetlb: avoid soft lockup when mprotect to large memory area

When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed:

watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916]

Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size.

Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too.

So add cond_resched() for hugetlb to avoid soft lockup.

Record: EUVD-2025-124930
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vxqq-p97q-mvpj No score

In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft...

In the Linux kernel, the following vulnerability has been resolved:

mm: hugetlb: avoid soft lockup when mprotect to large memory area

When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed:

watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916]

Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size.

Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too.

So add cond_resched() for hugetlb to avoid soft lockup.

Record: GHSA-vxqq-p97q-mvpj
Updated: 2026-11-02

NVD No score

In the Linux kernel, the following vulnerability has been resolved:

mm: hugetlb: avoid soft lockup when mprotect to large memory area

When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed:

watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916]

Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size.

Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too.

So add cond_resched() for hugetlb to avoid soft lockup.

Record: CVE-2025-40153
Updated: 2026-11-02

OSVOESA-2025-2765 7.3

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.(CVE-2025-22080)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-23150)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix OOB read when checking dotdot dir

Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when the corrupted directory is removed).

ext4_empty_dir() assumes every ext4 directory contains at least '.' and '..' as directory entries in the first data block. It first loads the '.' dir entry, performs sanity checks by calling ext4_check_dir_entry() and then uses its rec_len member to compute the location of '..' dir entry (in ext4_next_entry). It assumes the '..' dir entry fits into the same data block.

If the rec_len of '.' is precisely one block (4KB), it slips through the sanity checks (it is considered the last directory entry in the data block) and leaves "struct ext4_dir_entry_2 *de" point…

Record: OESA-2025-2765
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

Show 45 moreShow less

OSVOESA-2025-2766 7.3

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

cdx: Fix possible UAF error in driver_override_show()

Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c

This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs.

The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users.

Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues.

This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations.(CVE-2025-21915)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour…

Record: OESA-2025-2766
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

OSVOESA-2025-2767 7.3

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-23150)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix OOB read when checking dotdot dir

Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when the corrupted directory is removed).

If the rec_len of '.' is precisely one block (4KB), it slips through the sanity checks (it is considered the last directory entry in the data block) and leaves "struct ext4_dir_entry_2 *de" point…

Record: OESA-2025-2767
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

OSVCLSA-2025-1764085382 No score

kernel-uek: Fix of 236 CVEs

drm/amd/display: Skip on writeback when it's not applicable {CVE-2024-36914}
ASoC: topology: Fix references to freed memory {CVE-2024-41069}
Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
Bluetooth: SCO: Fix not validating setsockopt user input
drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
xfs: don't walk off the end of a directory data block {CVE-2024-41013}
wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
net/rds: Fix rs_recv_pending counting issue
LTS tag: v5.4.301
net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
media: s5p-mfc: remove an unused/uninitialized variable
NFSD: Fix last write offset handling in layoutcommit
NFSD: Minor cleanup in layoutcommit processing
padata: Reset next CPU when reorder sequence wraps around
KEYS: trusted_tpm1: Compare HMAC values in constant time
NFSD: Define a proc_layoutcommit for the FlexFiles layout type {CVE-2025-40087}
vfs: Don't leak disconnected dentries on umount {CVE-2025-40105}
jbd2: ensure that all ongoing I/O complete before freeing blocks
ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
drm/amdgpu: use atomic functions with memory barriers for vm fault info
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() {CVE-2025-40198}
spi: cadence-quadspi: Flush posted register writes before DAC access
spi: cadence-quadspi: Flush posted register writes before INDAC access
memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
memory: samsung: exynos-srom: Correct alignment
arm64: errata: Apply workarounds for Neoverse-V3AE
arm64: cputype: Add Neoverse-V3AE definitions
comedi: fix divide-by-zero in comedi_buf_munge() {CVE-2025-40106}
binder: remove "invalid inc weak" check
xhci: dbc: enable back DbC in resume if it was enabled before suspend
usb/core/quirks: Add Huawei ME906S to wakeup quirk
USB: serial: option: add Telit FN920C04 ECM compositions
USB: serial: option: add Quectel RG255C
USB: serial: option: add UNISOC UIS7720
net: ravb: Ensure memory write completes before ringing TX doorbell
net: usb: rtl8150: Fix frame padding
ocfs2: clear extent cache after moving/defragmenting extents
MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
Revert "cpuidle: menu: Avoid discarding useful information"
net: bonding: fix possible peer notify event loss or dup issue
sctp: avoid NULL dereference when chunk data buffer is missing
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
net: enetc: correct the value of ENETC_RXB_TRUESIZE
rtnetlink: Allow deleting FDB entries in user namespace
net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
net: add ndo_fdb_del_bulk
net: rtnetlink: add bulk delete support flag
net: netlink: add NLM_F_BULK delete request modifier
net: rtnetlink: use BIT for flag values
net: rtnetlink: add helper to extract msg type's kind
net: rtnetlink: add msg kind names
net: rtnetlink: remove redundant assignment to variable err
m68k: bitops: Fix find_*_bit() signatures
hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
dlm: check for defined force value in dlm_lockspace_release
hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
hfs: validate record offset in hfsplus_bmap_alloc
hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
hfs: make proper initalization of struct hfs_find_data
hfs: clear offset and space out of valid records in b-tree node
exec: Fix incorrect type for ret
hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() {CVE-2025-40088}
ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
sched/fair: Fix pelt lost idle time…

Record: CLSA-2025-1764085382
Updated: 2026-11-02

OSVCLSA-2026-1787307395 No score

kernel: Fix of 83 CVEs

net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138}
static_call: Replace pointless WARN_ON() in static_call_module_notify() {CVE-2024-49954}
static_call: Handle module init failure correctly in static_call_del_module() {CVE-2024-50002}
smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350}
octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978}
scsi: core: Fix refcount leak for tagset_refcnt {CVE-2026-23296}
wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() {CVE-2026-23336}
smb: client: fix memory leak in cifs_construct_tcon() {CVE-2025-68295}
sched/deadline: Fix warning in migrate_enable for boosted tasks {CVE-2024-56583}
nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() {CVE-2025-40261}
usbnet: Prevents free active kevent {CVE-2025-68312}
libceph: bound get_version reply decode to front len {CVE-2026-68433}
neigh: let neigh_xmit take skb ownership {CVE-2026-52981}
gve: prevent ethtool ops after shutdown {CVE-2025-38735}
vfs: Don't leak disconnected dentries on umount {CVE-2025-40105}
NFSD: NFSv4 file creation neglects setting ACL {CVE-2025-68803}
thermal: intel: int340x: processor: Fix warning during module unload {CVE-2024-50093}
quota: fix warning in dqgrab() {CVE-2023-54177}
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458}
net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change {CVE-2025-71066}
bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue {CVE-2024-36938}
net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}
xsk: tighten UMEM headroom validation to account for tailroom and min frame {CVE-2026-43093}
drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) {CVE-2024-39497}
bpf: Fix OOB in pcpu_init_value {CVE-2026-53076}
ftrace: Clean up hash direct_functions on register failures {CVE-2022-49402}
binfmt_misc: restore write access before closing files opened by open_exec() {CVE-2025-68239}
smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path {CVE-2025-39929}
wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() {CVE-2026-53102}
xen: Add support for XenServer 6.1 platform device {CVE-2025-38046}
i2c: tegra: Do not mark ACPI devices as irq safe {CVE-2024-45029}
bpf: Add preempt_count_{sub,add} into btf id deny list {CVE-2023-54086}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}
net/mlx5: Fix missing lock on sync reset reload {CVE-2024-42268}
vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels {CVE-2026-23274}
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations {CVE-2026-31394}
bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path {CVE-2026-53096}
scsi: mpi3mr: Fix possible crash when setting up bsg fails {CVE-2025-21723}
net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup {CVE-2025-68192}
net: stream: purge sk_error_queue in sk_stream_kill_queues() {CVE-2022-50838}
clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context {CVE-2025-21767}
net: netpoll: fix incorrect refcount handling causing incorrect cleanup {CVE-2025-68245}
drm/amd/display: Check link_res->hpo_dp_link_enc before using it {CVE-2024-47704}
crypto: qat - flush misc workqueue during device shutdown {CVE-2025-39721}
crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698}
smb: client: split cached_fid bitfields to avoid…

Record: CLSA-2026-1787307395
Updated: 2026-11-02

OSVCLSA-2026-1791800936 No score

kernel: Fix of 191 CVEs

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818}
drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199}
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199}
drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230}
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230}
openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165}
openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678}
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs {CVE-2026-74642}
ALSA: usb-audio: fix use-after-free in ump_to_endpoint() {CVE-2026-74501}
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
exec: do_close_on_exec() before taking exec_update_lock {CVE-2026-64371}
proc: Fix broken error paths for namespace links {CVE-2026-64371}
proc: protect ptrace_may_access() with exec_update_lock (part 1) {CVE-2026-64371}
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes {CVE-2026-74503}
ALSA: timer: Forcibly close timer instances at closing {CVE-2026-53193}
usb: typec: ucsi: Fix race condition and ordering in port unregistration {CVE-2026-74441}
arp: do not assume dev_hard_header() does not change skb->head {CVE-2026-22988}
netfilter: nft_ct: fix use-after-free in timeout object destroy {CVE-2026-31665}
md/raid10: fix writes_pending and barrier reference leaks on discard failures {CVE-2026-72438}
md/raid10: fix deadlock with check operation and nowait requests {CVE-2026-46050}
mm: introduce and use {pgd,p4d}_populate_kernel() {CVE-2025-39844}
vsock/virtio: fix zerocopy completion for multi-skb sends {CVE-2026-53365}
vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting {CVE-2026-52994}
mm: do file ownership checks with the proper mount idmap {CVE-2026-64294}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths {CVE-2026-45870}
Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig {CVE-2026-53208}
slip: bound decode() reads against the compressed packet length {CVE-2026-45843}
net: tls: fix strparser anchor skb leak on offload RX setup failure {CVE-2026-52974}
netfilter: nf_tables: unconditionally bump set->nelems before insertion {CVE-2026-23272}
rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131}
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() {CVE-2026-23458}
mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr {CVE-2025-21938}
bpf: Fix NULL deref in map_kptr_match_type for scalar regs {CVE-2026-53032}
bpf: Explicitly check accesses to bpf_sock_addr {CVE-2025-40078}
nexthop: Forbid FDB status change while nexthop is in a group {CVE-2025-39980}
bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN {CVE-2026-31525}
x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() {CVE-2025-21913}
ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() {CVE-2024-57994}
drm/i915/vrr: require valid min/max vfreq for VRR {CVE-2026-68254}
libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954}
gfs2: prevent NULL pointer dereference during unmount {CVE-2026-53048}
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path {CVE-2026-31708}
ext4: reject mount if bigalloc with s_first_data_block != 0 {CVE-2026-31447}
NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324}
netfilter: x_tables: guard option walkers against 1-byte tail reads {CVE-2026-43452}
smb: client: Fix refcount leak for cifs_sb_tlink {CVE-2025-40103}
smb: client: harden POSIX SID length parsing {CVE-2026-64380}
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
bpf: Allow LPM map access from sleepable…

Record: CLSA-2026-1791800936
Updated: 2026-11-02

OSV No score

mm: hugetlb: avoid soft lockup when mprotect to large memory area

In the Linux kernel, the following vulnerability has been resolved:

mm: hugetlb: avoid soft lockup when mprotect to large memory area

When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was observed:

watchdog: BUG: soft lockup - CPU#98 stuck for 23s! [t2_new_sysv:126916]

Soft lockup is not triggered with THP or base page because there is cond_resched() called for each PMD size.

Although the soft lockup was triggered by MTE, it should be not MTE specific. The other processing which takes long time in the loop may trigger soft lockup too.

So add cond_resched() for hugetlb to avoid soft lockup.

Record: CVE-2025-40153
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-40153 No score

Record: DEBIAN-CVE-2025-40153
Updated: 2026-11-02

OSVopenSUSE-SU-2025:20172-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
CVE-2025-40134: dm: fix NULL pointer dereference in…

Record: openSUSE-SU-2025:20172-1
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2025-40153 No score

CVE-2025-40153 in linux - Patched by Root

Root has patched CVE-2025-40153 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2025-40153
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-13-CVE-2025-40153 No score

CVE-2025-40153 in linux - Patched by Root

Root has patched CVE-2025-40153 in the linux package for Root:Debian:13. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-13-CVE-2025-40153
Updated: 2026-11-03

OSVROOT-OS-UBUNTU-2404-CVE-2025-40153 No score

CVE-2025-40153 in linux - Patched by Root

Root has patched CVE-2025-40153 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-40153
Updated: 2026-11-06

OSVSUSE-SU-2026:0278-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

Record: SUSE-SU-2026:0278-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0281-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

Record: SUSE-SU-2026:0281-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0293-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).

The following non security issues were fixed:

ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes).
ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes).
ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes).
ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes).
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes).
ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes).
ALSA: uapi: Fix typo in asound.h comment (git-fixes).
ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes).
ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes).
ASoC: ak4458: Disable regulator when error happens (git-fixes).
ASoC: ak5558: Disable regulator when error happens (git-fixes).
ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes).
ASoC: fsl_xcvr: clear the channel status control memory (git-fixes).
ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes).
ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes).
ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment…

Record: SUSE-SU-2026:0293-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0315-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

Record: SUSE-SU-2026:0315-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0316-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-49604,CVE-2025-40074: ip: Fix data-races around sysctl_ip_fwd_use_pmtu (bsc#1238414 bsc#1252794).
CVE-2022-50527: drm/amdgpu: Fix size validation for non-exclusive domains (v4) (bsc#1251738).
CVE-2022-50625: serial: amba-pl011: avoid SBSA UART accessing DMACR register (bsc#1254559).
CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
CVE-2022-50656: nfc: pn533: Clear nfc_target before being used (bsc#1254745).
CVE-2022-50678: wifi: brcmfmac: fix invalid address access when enabling SCAN log level (bsc#1254902).
CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
CVE-2023-53454: HID: multitouch: Correct devm device reference for hidinput input_dev name (bsc#1250759).
CVE-2023-53718: ring-buffer: Do not swap cpu_buffer during resize process (bsc#1252564).
CVE-2023-53748: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup (bsc#1254907).
CVE-2023-53765: dm cache: free background tracker's queued work in btracker_destroy (bsc#1254912).
CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
CVE-2023-53788: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (bsc#1254917).
CVE-2023-53819: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va (bsc#1254712).
CVE-2023-53850: iavf: use internal state to free traffic IRQs (bsc#1254677).
CVE-2023-54120: Bluetooth: Fix race condition in hidp_session_thread (bsc#1256133).
CVE-2023-54214: Bluetooth: L2CAP: Fix potential user-after-free (bsc#1255954).
CVE-2023-54236: net/net_failover: fix txq exceeding warning (bsc#1255922).
CVE-2023-54286: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (bsc#1255803).
CVE-2023-54300: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (bsc#1255790).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38336: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (bsc#1246370).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40035: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (bsc#1252866).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40110: drm/vmwgfx: Fix a null-ptr access in the cursor snooper (bsc#1253275).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40164: usbnet: Fix using smp_processor_id() in preemptible code warnings (bsc#1253407).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40198: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (bsc#1253453). -…

Record: SUSE-SU-2026:0316-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20012-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
CVE-2025-40134: dm: fix NULL pointer dereference in…

Record: SUSE-SU-2026:20012-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20015-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
CVE-2025-40134: dm: fix NULL pointer dereference in…

Record: SUSE-SU-2026:20015-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20021-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
CVE-2025-40134: dm: fix NULL pointer dereference in…

Record: SUSE-SU-2026:20021-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20477-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in…

Record: SUSE-SU-2026:20477-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20498-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in…

Record: SUSE-SU-2026:20498-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20562-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
CVE-2025-40134: dm: fix NULL pointer dereference in…

Record: SUSE-SU-2026:20562-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20845-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Record: SUSE-SU-2026:20845-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20876-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Record: SUSE-SU-2026:20876-1
Updated: 2026-11-02

OSVUSN-8029-1 No score

linux, linux-raspi, linux-realtime vulnerabilities