CVE-2025-40200

The Linux Kernel, the operating system core itself.

Security Fix(es):

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

In the Linux kernel, the following vulnerability has been resolved:

cdx: Fix possible UAF error in driver_override_show()

Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c

This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs.

The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users.

Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues.

This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations.(CVE-2025-21915)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.(CVE-2025-22080)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour…

The Linux Kernel, the operating system core itself.

Security Fix(es):

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.(CVE-2024-36357)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Prevent integer overflow in hdr_first_de()

The "de_off" and "used" variables come from the disk so they both need to check. The problem is that on 32bit systems if they're both greater than UINT_MAX - 16 then the check does work as intended because of an integer overflow.(CVE-2025-22080)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix off-by-one error in do_split

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431 vfs_symlink+0x137/0x2e0 fs/namei.c:4615 do_symlinkat+0x222/0x3a0 fs/namei.c:4641 __do_sys_symlink fs/namei.c:4662 [inline] __se_sys_symlink fs/namei.c:4660 [inline] __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) { /* is more than half of this entry in 2nd half of the block? */ if (size + map[i].size/2 > blocksize/2) break; size += map[i].size; move++; }

'i' in this case could go down to -1, in which case sum of active entries wouldn't exceed half the block size, but previous behaviour would also do split in half if sum would exceed at the very last block, which in case of having too many long name files in a single block could lead to out-of-bounds access and following use-after-free.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-23150)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix OOB read when checking dotdot dir

Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, when the corrupted directory is removed).

ext4_empty_dir() assumes every ext4 directory contains at least '.' and '..' as directory entries in the first data block. It first loads the '.' dir entry, performs sanity checks by calling ext4_check_dir_entry() and then uses its rec_len member to compute the location of '..' dir entry (in ext4_next_entry). It assumes the '..' dir entry fits into the same data block.

If the rec_len of '.' is precisely one block (4KB), it slips through the sanity checks (it is considered the last directory entry in the data block) and leaves "struct ext4_dir_entry_2 *de" point…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()

I found a null pointer reference in arch_prepare_kprobe():

echo 'p cmdline_proc_show' > kprobe_events

echo 'p cmdline_proc_show+16' >> kprobe_events

Kernel attempted to read user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc000000000050bfc Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 122 Comm: sh Not tainted 6.0.0-rc3-00007-gdcf8e5633e2e #10 NIP: c000000000050bfc LR: c000000000050bec CTR: 0000000000005bdc REGS: c0000000348475b0 TRAP: 0300 Not tainted (6.0.0-rc3-00007-gdcf8e5633e2e) MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 88002444 XER: 20040006 CFAR: c00000000022d100 DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 0 ... NIP arch_prepare_kprobe+0x10c/0x2d0 LR arch_prepare_kprobe+0xfc/0x2d0 Call Trace: 0xc0000000012f77a0 (unreliable) register_kprobe+0x3c0/0x7a0 __register_trace_kprobe+0x140/0x1a0 __trace_kprobe_create+0x794/0x1040 trace_probe_create+0xc4/0xe0 create_or_delete_trace_kprobe+0x2c/0x80 trace_parse_run_command+0xf0/0x210 probes_write+0x20/0x40 vfs_write+0xfc/0x450 ksys_write+0x84/0x140 system_call_exception+0x17c/0x3a0 system_call_vectored_common+0xe8/0x278 --- interrupt: 3000 at 0x7fffa5682de0 NIP: 00007fffa5682de0 LR: 0000000000000000 CTR: 0000000000000000 REGS: c000000034847e80 TRAP: 3000 Not tainted (6.0.0-rc3-00007-gdcf8e5633e2e) MSR: 900000000280f033 <SF,HV,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 44002408 XER: 00000000

The address being probed has some special:

cmdline_proc_show: Probe based on ftrace cmdline_proc_show+16: Probe for the next instruction at the ftrace location

The ftrace-based kprobe does not generate kprobe::ainsn::insn, it gets set to NULL. In arch_prepare_kprobe() it will check for:

... prev = get_kprobe(p->addr - 1); preempt_enable_no_resched(); if (prev && ppc_inst_prefixed(ppc_inst_read(prev->ainsn.insn))) { ...

If prev is based on ftrace, 'ppc_inst_read(prev->ainsn.insn)' will occur with a null pointer reference. At this point prev->addr will not be a prefixed instruction, so the check can be skipped.

Check if prev is ftrace-based kprobe before reading 'prev->ainsn.insn' to fix this problem.

mpe: Trim oops

In the Linux kernel, the following vulnerability has been resolved:

erofs: validate the extent length for uncompressed pclusters

syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2

The referenced fuzzed image actually has two issues:

• m_pa == 0 as a non-inlined pcluster;
• The logical length is longer than its physical length.

The first issue has already been addressed. This patch addresses the second issue by checking the extent length validity.(CVE-2022-50746)

In the Linux kernel, the following vulnerability has been resolved:

smc: Fix use-after-free in tcp_write_timer_handler().

With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0]

If SMC creates a kernel socket in __smc_create(), the kernel socket is supposed to be freed in smc_clcsock_release() by calling sock_release() when we close() the parent SMC socket.

However, at the end of smc_clcsock_release(), the kernel socket's sk_state might not be TCP_CLOSE. This means that we have not called inet_csk_destroy_sock() in __tcp_close() and have not stopped the TCP timers.

The kernel socket's TCP timers can be fired later, so we need to hold a refcnt for net as we do…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

erofs: validate the extent length for uncompressed pclusters

syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2

The referenced fuzzed image actually has two issues:

• m_pa == 0 as a non-inlined pcluster;
• The logical length is longer than its physical length.

The first issue has already been addressed. This patch addresses the second issue by checking the extent length validity.(CVE-2022-50746)

In the Linux kernel, the following vulnerability has been resolved:

smc: Fix use-after-free in tcp_write_timer_handler().

With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0]

If SMC creates a kernel socket in __smc_create(), the kernel socket is supposed to be freed in smc_clcsock_release() by calling sock_release() when we close() the parent SMC socket.

However, at the end of smc_clcsock_release(), the kernel socket's sk_state might not be TCP_CLOSE. This means that we have not called inet_csk_destroy_sock() in __tcp_close() and have not stopped the TCP timers.

The kernel socket's TCP timers can be fired later, so we need to hold a refcnt for net as we do for MPTCP subflows in mptcp_subflow_create_socket().

[0]: leaked reference. sk_alloc (./include/net/net_namespace.h:335 net/core/sock.c:2108) inet_create (net/ipv4/af_inet.c:319 net/ipv4/af_inet.c:244) __sock_create (net/socket.c:1546) smc_create (net/smc/af_smc.c:3269 net/smc/af_smc.c:3284) __sock_create (net/socket.c:1546) __sys_socket (net/socket.c:1634 net/socket.c:1618 net/socket.c:1661) __x64_sys_socket (net/socket.c:1672) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)

BUG: KASAN: slab-use-after-free in tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) Read of size 1 at addr ffff888052b65e0d by task syzrepro/18091

CPU: 0 PID: 18091 Comm: syzrepro Tainted: G W 6.3.0-rc4-01174-gb5d54eb5899a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:107) print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) kasan_report (mm/kasan/report.c:538) tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) tcp_write_timer (./include/linux/spinlock.h:390 net/ipv4/tcp_timer.c:643) call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701) __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2022) run_timer_softirq (kernel/time/timer.c:2037) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572) __irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650) irq_exit_rcu (kernel/softirq.c:664) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1107 (discriminator 14)) </IRQ>(CVE-2023-53781)

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to do sanity check on direct node in truncate_dnode()

syzbot reports below bug:

BUG: KASAN: slab-use-after-free in f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574 Read of size 4 at addr ffff88802a25c000 by task syz-executor148/5000

CPU: 1 PID: 5000 Comm: syz-executor148 Not tainted 6.4.0-rc7-syzkaller-00041-ge660abd551f1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 …

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: reject negative file sizes in squashfs_read_inode()

Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.

This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size.

This commit checks for a negative file size and returns EINVAL.

[[email protected]: only need to check 64 bit quantity]

• drm/amd/display: Skip on writeback when it's not applicable {CVE-2024-36914}
• ASoC: topology: Fix references to freed memory {CVE-2024-41069}
• Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
• Bluetooth: SCO: Fix not validating setsockopt user input
• drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
• xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
• Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()"
• net/rds: Fix rs_recv_pending counting issue
• LTS tag: v5.4.301
• net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg
• media: s5p-mfc: remove an unused/uninitialized variable
• NFSD: Fix last write offset handling in layoutcommit
• NFSD: Minor cleanup in layoutcommit processing
• padata: Reset next CPU when reorder sequence wraps around
• KEYS: trusted_tpm1: Compare HMAC values in constant time
• NFSD: Define a proc_layoutcommit for the FlexFiles layout type {CVE-2025-40087}
• vfs: Don't leak disconnected dentries on umount {CVE-2025-40105}
• jbd2: ensure that all ongoing I/O complete before freeing blocks
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• drm/amdgpu: use atomic functions with memory barriers for vm fault info
• ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() {CVE-2025-40198}
• spi: cadence-quadspi: Flush posted register writes before DAC access
• spi: cadence-quadspi: Flush posted register writes before INDAC access
• memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe
• memory: samsung: exynos-srom: Correct alignment
• arm64: errata: Apply workarounds for Neoverse-V3AE
• arm64: cputype: Add Neoverse-V3AE definitions
• comedi: fix divide-by-zero in comedi_buf_munge() {CVE-2025-40106}
• binder: remove "invalid inc weak" check
• xhci: dbc: enable back DbC in resume if it was enabled before suspend
• usb/core/quirks: Add Huawei ME906S to wakeup quirk
• USB: serial: option: add Telit FN920C04 ECM compositions
• USB: serial: option: add Quectel RG255C
• USB: serial: option: add UNISOC UIS7720
• net: ravb: Ensure memory write completes before ringing TX doorbell
• net: usb: rtl8150: Fix frame padding
• ocfs2: clear extent cache after moving/defragmenting extents
• MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering
• Revert "cpuidle: menu: Avoid discarding useful information"
• net: bonding: fix possible peer notify event loss or dup issue
• sctp: avoid NULL dereference when chunk data buffer is missing
• arm64, mm: avoid always making PTE dirty in pte_mkwrite()
• net: enetc: correct the value of ENETC_RXB_TRUESIZE
• rtnetlink: Allow deleting FDB entries in user namespace
• net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del
• net: add ndo_fdb_del_bulk
• net: rtnetlink: add bulk delete support flag
• net: netlink: add NLM_F_BULK delete request modifier
• net: rtnetlink: use BIT for flag values
• net: rtnetlink: add helper to extract msg type's kind
• net: rtnetlink: add msg kind names
• net: rtnetlink: remove redundant assignment to variable err
• m68k: bitops: Fix find_*_bit() signatures
• hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super()
• hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits()
• dlm: check for defined force value in dlm_lockspace_release
• hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
• hfs: validate record offset in hfsplus_bmap_alloc
• hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent()
• hfs: make proper initalization of struct hfs_find_data
• hfs: clear offset and space out of valid records in b-tree node
• exec: Fix incorrect type for ret
• hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() {CVE-2025-40088}
• ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings
• sched/fair: Fix pelt lost idle time…

• sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138}
• net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() {CVE-2025-40187}
• sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
• ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() {CVE-2026-53221}
• cifs: some missing initializations on replay {CVE-2026-31693}
• drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286}
• net/tcp-md5: Fix MAC comparison to be constant-time {CVE-2026-43383}
• ima: Handle error code returned by ima_filter_rule_match() {CVE-2025-68740}
• accel/ivpu: Add bounds check for firmware runtime memory {CVE-2026-53206}
• ata: libata-core: Disable LPM on ST1000DM010-2EP102 {CVE-2026-43487}
• ip6_vti: prevent moving the fallback device across netns {CVE-2026-52909}
• NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags {CVE-2025-68764}
• bonding: fix devconf_all NULL dereference when IPv6 is disabled {CVE-2026-68336}
• mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}
• octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978}
• net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}
• spi: fix use-after-free on controller registration failure {CVE-2026-31389}
• nvme: fix admin request_queue lifetime {CVE-2025-68265}
• RDMA/bnxt_re: Add sanity checks on rdev validity {CVE-2025-21901}
• smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350}
• net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow {CVE-2025-39834}
• sctp: Fix MAC comparison to be constant-time {CVE-2025-40204}
• net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path {CVE-2025-39830}
• nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() {CVE-2026-23297}
• thermal/of: Fix reference leak in thermal_of_cm_lookup() {CVE-2026-45925}
• usbnet: Prevents free active kevent {CVE-2025-68312}
• smb: client: fix oops due to uninitialised var in smb2_unlink() {CVE-2026-23282}
• fs/buffer: add alert in try_to_free_buffers() for folios without buffers {CVE-2025-71295}
• cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update {CVE-2025-23137}
• Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync {CVE-2026-53251}
• wifi: iwlwifi: mvm: don't send a 6E related command when not supported {CVE-2026-43325}
• io_uring/napi: cap busy_poll_to 10 msec {CVE-2026-53321}
• io_uring/net: fix io_req_post_cqe abuse by send bundle {CVE-2025-23154}
• xfs: fix a resource leak in xfs_alloc_buftarg() {CVE-2026-46005}
• firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() {CVE-2026-68444}
• i2c: core: fix adapter deregistration race {CVE-2026-64279}
• wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() {CVE-2026-68439}
• firmware: arm_ffa: Check for NULL FF-A ID table while driver registration {CVE-2026-64166}
• wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() {CVE-2026-68309}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698}
• ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408}
• accel/ivpu: Add bounds checks for firmware log indices {CVE-2026-53205}
• PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails {CVE-2026-45880}
• nvme-multipath: fix lockdep WARN due to partition scan work {CVE-2025-68218}
• dm: fix unlocked test for dm_suspended_md {CVE-2026-46327}
• net: slip: serialize receive against buffer reallocation…

• net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138}
• static_call: Replace pointless WARN_ON() in static_call_module_notify() {CVE-2024-49954}
• static_call: Handle module init failure correctly in static_call_del_module() {CVE-2024-50002}
• smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350}
• octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978}
• scsi: core: Fix refcount leak for tagset_refcnt {CVE-2026-23296}
• wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() {CVE-2026-23336}
• smb: client: fix memory leak in cifs_construct_tcon() {CVE-2025-68295}
• sched/deadline: Fix warning in migrate_enable for boosted tasks {CVE-2024-56583}
• nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() {CVE-2025-40261}
• usbnet: Prevents free active kevent {CVE-2025-68312}
• libceph: bound get_version reply decode to front len {CVE-2026-68433}
• neigh: let neigh_xmit take skb ownership {CVE-2026-52981}
• gve: prevent ethtool ops after shutdown {CVE-2025-38735}
• vfs: Don't leak disconnected dentries on umount {CVE-2025-40105}
• NFSD: NFSv4 file creation neglects setting ACL {CVE-2025-68803}
• thermal: intel: int340x: processor: Fix warning during module unload {CVE-2024-50093}
• quota: fix warning in dqgrab() {CVE-2023-54177}
• mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458}
• net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change {CVE-2025-71066}
• bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue {CVE-2024-36938}
• net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}
• xsk: tighten UMEM headroom validation to account for tailroom and min frame {CVE-2026-43093}
• drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) {CVE-2024-39497}
• bpf: Fix OOB in pcpu_init_value {CVE-2026-53076}
• ftrace: Clean up hash direct_functions on register failures {CVE-2022-49402}
• binfmt_misc: restore write access before closing files opened by open_exec() {CVE-2025-68239}
• smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path {CVE-2025-39929}
• wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() {CVE-2026-53102}
• xen: Add support for XenServer 6.1 platform device {CVE-2025-38046}
• i2c: tegra: Do not mark ACPI devices as irq safe {CVE-2024-45029}
• bpf: Add preempt_count_{sub,add} into btf id deny list {CVE-2023-54086}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}
• net/mlx5: Fix missing lock on sync reset reload {CVE-2024-42268}
• vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
• netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels {CVE-2026-23274}
• drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
• mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations {CVE-2026-31394}
• bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path {CVE-2026-53096}
• scsi: mpi3mr: Fix possible crash when setting up bsg fails {CVE-2025-21723}
• net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup {CVE-2025-68192}
• net: stream: purge sk_error_queue in sk_stream_kill_queues() {CVE-2022-50838}
• clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context {CVE-2025-21767}
• net: netpoll: fix incorrect refcount handling causing incorrect cleanup {CVE-2025-68245}
• drm/amd/display: Check link_res->hpo_dp_link_enc before using it {CVE-2024-47704}
• crypto: qat - flush misc workqueue during device shutdown {CVE-2025-39721}
• crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698}
• smb: client: split cached_fid bitfields to avoid…

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: reject negative file sizes in squashfs_read_inode()

Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs.

This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size.

This commit checks for a negative file size and returns EINVAL.

[[email protected]: only need to check 64 bit quantity]

In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs file system returns a file with a negative file size. This commit checks for a negative file size and returns EINVAL. [[email protected]: only need to check 64 bit quantity]

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
• CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
• CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
• CVE-2025-40134: dm: fix NULL pointer dereference in…

Root has patched CVE-2025-40200 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
• CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
• CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
• CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
• CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
• CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
• CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
• CVE-2025-40185: ice: ice_adapter: release xa entry on adapter allocation failure (bsc#1253394).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).

The following non security issues were fixed:

• ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).
• ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).
• ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).
• ACPI: PRM:…

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
• CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
• CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
• CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
• CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
• CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
• CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).

The following non security issues were fixed:

• ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).
• ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).
• ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).
• ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).
• ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).
• ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).
• ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).
• ACPICA: Update dsmethod.c to get rid of unused variable warning…

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
• CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
• CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
• CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
• CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
• CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
• CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).

The following non-security bugs were fixed:

• ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).
• ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).
• ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).
• ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).
• ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).
• ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).
• ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).
• ACPICA: Update dsmethod.c to get rid of unused variable…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
• CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
• CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
• CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
• CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40080: nbd: restrict sockets to TCP and UDP (bsc#1252774).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
• CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
• CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
• CVE-2025-40185: ice: ice_adapter: release xa entry on adapter allocation failure (bsc#1253394).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).
• CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1250237 bsc#1253393).

The following non-security bugs were fixed:

• ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).
• ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
• CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
• CVE-2025-38360: drm/amd/display: Add more checks for DSC / HUBP ONO guarantees (bsc#1247078).
• CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
• CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
• CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
• CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
• CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
• CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
• CVE-2025-40185: ice: ice_adapter: release xa entry on adapter allocation failure (bsc#1253394).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).

The following non-security bugs were fixed:

• ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).
• ACPI: CPPC: Limit perf ctrs in PCC…

The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
• CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
• CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
• CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
• CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
• CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
• CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).

The following non-security bugs were fixed:

• ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).
• ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).
• ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).
• ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).
• ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).
• ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).
• ACPI: scan: Add Intel CVS ACPI HIDs to acpi_ignore_dep_ids (stable-fixes).
• ACPICA: Update dsmethod.c to get rid of unused variable…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-49604,CVE-2025-40074: ip: Fix data-races around sysctl_ip_fwd_use_pmtu (bsc#1238414 bsc#1252794).
• CVE-2022-50527: drm/amdgpu: Fix size validation for non-exclusive domains (v4) (bsc#1251738).
• CVE-2022-50625: serial: amba-pl011: avoid SBSA UART accessing DMACR register (bsc#1254559).
• CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
• CVE-2022-50656: nfc: pn533: Clear nfc_target before being used (bsc#1254745).
• CVE-2022-50678: wifi: brcmfmac: fix invalid address access when enabling SCAN log level (bsc#1254902).
• CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
• CVE-2023-53454: HID: multitouch: Correct devm device reference for hidinput input_dev name (bsc#1250759).
• CVE-2023-53718: ring-buffer: Do not swap cpu_buffer during resize process (bsc#1252564).
• CVE-2023-53748: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup (bsc#1254907).
• CVE-2023-53765: dm cache: free background tracker's queued work in btracker_destroy (bsc#1254912).
• CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
• CVE-2023-53788: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (bsc#1254917).
• CVE-2023-53819: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va (bsc#1254712).
• CVE-2023-53850: iavf: use internal state to free traffic IRQs (bsc#1254677).
• CVE-2023-54120: Bluetooth: Fix race condition in hidp_session_thread (bsc#1256133).
• CVE-2023-54214: Bluetooth: L2CAP: Fix potential user-after-free (bsc#1255954).
• CVE-2023-54236: net/net_failover: fix txq exceeding warning (bsc#1255922).
• CVE-2023-54286: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (bsc#1255803).
• CVE-2023-54300: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (bsc#1255790).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
• CVE-2025-38336: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (bsc#1246370).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40035: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (bsc#1252866).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40110: drm/vmwgfx: Fix a null-ptr access in the cursor snooper (bsc#1253275).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40164: usbnet: Fix using smp_processor_id() in preemptible code warnings (bsc#1253407).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40198: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (bsc#1253453). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
• CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
• CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
• CVE-2025-40134: dm: fix NULL pointer dereference in…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
• CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
• CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
• CVE-2025-40134: dm: fix NULL pointer dereference in…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
• CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
• CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
• CVE-2025-40134: dm: fix NULL pointer dereference in…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
• CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
• CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
• CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
• CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: net: dst_cache: annotate data-races around dst_cache->reset_ts (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
• CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
• CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).
• CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1250237 bsc#1253393).

The following non-security bugs were fixed:

• ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).
• ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).
• ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).
• ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).
• ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).
• ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).
• ACPI:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
• CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
• CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
• CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
• CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: net: dst_cache: annotate data-races around dst_cache->reset_ts (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
• CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
• CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).
• CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1250237 bsc#1253393).

The following non-security bugs were fixed:

• ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).
• ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).
• ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).
• ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).
• ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).
• ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).
• ACPI:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
• CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
• CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
• CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
• CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40105: vfs: Do not leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
• CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
• CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).
• CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1253393).

The following non-security bugs were fixed:

• ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).
• ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).
• ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).
• ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).
• ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).
• ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).
• ACPI: scan: Add Intel CVS ACPI HIDs to…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2023-53676: scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() (bsc#1251786).
• CVE-2025-21710: tcp: correct handling of extreme memory squeeze (bsc#1237888).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38359: s390/mm: Fix in_atomic() handling in do_secure_storage_access() (bsc#1247076).
• CVE-2025-38361: drm/amd/display: Check dce_hwseq before dereferencing it (bsc#1247079).
• CVE-2025-39788: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE (bsc#1249547).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40030: pinctrl: check the return value of pinmux_ops::get_function_name() (bsc#1252773).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40040: mm/ksm: fix flag-dropping behavior in ksm_madvise (bsc#1252780).
• CVE-2025-40048: uio_hv_generic: Let userspace take care of interrupt mask (bsc#1252862).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: ipv4: start using dst_dev_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40105: vfs: Do not leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
• CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
• CVE-2025-40159: xsk: Harden userspace-supplied xdp_desc validation (bsc#1253403).
• CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
• CVE-2025-40169: bpf: Reject negative offsets for ALU ops (bsc#1253416).
• CVE-2025-40173: net/ip6_tunnel: Prevent perpetual tunnel growth (bsc#1253421).
• CVE-2025-40176: tls: wait for pending async decryptions if tls_strp_msg_hold fails (bsc#1253425).
• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253436).
• CVE-2025-40206: Add missing bugzilla reference to net fix (bsc#1253393).

The following non-security bugs were fixed:

• ACPI: CPPC: Check _CPC validity for only the online CPUs (git-fixes).
• ACPI: CPPC: Limit perf ctrs in PCC check only to online CPUs (git-fixes).
• ACPI: CPPC: Perform fast check switch only for online CPUs (git-fixes).
• ACPI: PRM: Skip handlers with NULL handler_address or NULL VA (stable-fixes).
• ACPI: SBS: Fix present test in acpi_battery_read() (git-fixes).
• ACPI: property: Return present device nodes only on fwnode interface (stable-fixes).
• ACPI: scan: Add Intel CVS ACPI HIDs to…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50253: bpf: make sure skb->len != 0 when redirecting to a tunneling device (bsc#1249912).
• CVE-2025-37916: pds_core: remove write-after-free of client_id (bsc#1243474).
• CVE-2025-38084: mm/hugetlb: unshare page tables during VMA split, not before (bsc#1245431 bsc#1245498).
• CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39805: net: macb: fix unregister_netdev call order in macb_remove() (bsc#1249982).
• CVE-2025-39819: fs/smb: Fix inconsistent refcnt update (bsc#1250176).
• CVE-2025-39822: io_uring/kbuf: fix signedness in this_len calculation (bsc#1250034).
• CVE-2025-39831: fbnic: Move phylink resume out of service_task and into open/close (bsc#1249977).
• CVE-2025-39859: ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog (bsc#1250252).
• CVE-2025-39897: net: xilinx: axienet: Add error handling for RX metadata pointer retrieval (bsc#1250746).
• CVE-2025-39917: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt (bsc#1250723).
• CVE-2025-39944: octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() (bsc#1251120).
• CVE-2025-39961: iommu/amd/pgtbl: Fix possible race while increase page table level (bsc#1251817).
• CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group (bsc#1252063).
• CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto (bsc#1252054).
• CVE-2025-40001: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue (bsc#1252303).
• CVE-2025-40003: net: mscc: ocelot: Fix use-after-free caused by cyclic delayed work (bsc#1252301).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40021: tracing: dynevent: Add a missing lockdown check on dynevent (bsc#1252681).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40027: net/9p: fix double req put in p9_fd_cancelled (bsc#1252763).
• CVE-2025-40031: tee: fix register_shm_helper() (bsc#1252779).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40038: KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid (bsc#1252817).
• CVE-2025-40047: io_uring/waitid: always prune wait queue entry in io_waitid_wait() (bsc#1252790).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40055: ocfs2: fix double free in user_cluster_connect() (bsc#1252821).
• CVE-2025-40059: coresight: Fix incorrect handling for return value of devm_kzalloc (bsc#1252809).
• CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
• CVE-2025-40070: pps: fix warning in pps_register_cdev when register device fail (bsc#1252836).
• CVE-2025-40074: tcp: convert to dev_net_rcu() (bsc#1252794).
• CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40083: net/sched: sch_qfq: Fix null-deref in agg_dequeue (bsc#1252912).
• CVE-2025-40086: drm/xe: Don't allow evicting of BOs in same VM in array of VM binds (bsc#1252923).
• CVE-2025-40098: ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (bsc#1252917).
• CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST (bsc#1252901).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40105: vfs: Don't leak disconnected dentries on umount (bsc#1252928).
• CVE-2025-40133: mptcp: Call dst_release() in mptcp_active_enable() (bsc#1253328).
• CVE-2025-40134: dm: fix NULL pointer dereference in…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Device frequency scaling framework;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• Hardware monitoring drivers;
• HW tracing;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• PCI Endpoint Test driver;
• VMware Balloon Driver;
• MOST (Media Oriented Systems Transport) drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Mellanox platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Mellanox drivers;
• Memory management;
• Virtio network driver;
• Bluetooth subsystem;
• IP tunnels definitions;
• io_uring subsystem;
• Kernel crash support code;
• Perf events;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Network traffic control;
• SCTP protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• VMware vSockets driver;
• eXpress Data Path;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• ALSA framework;
• HD-audio driver;
• AMD SoC Alsa drivers;
• WCD audio codecs;
• Intel ASoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Device frequency scaling framework;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• Hardware monitoring drivers;
• HW tracing;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• PCI Endpoint Test driver;
• VMware Balloon Driver;
• MOST (Media Oriented Systems Transport) drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Mellanox platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Mellanox drivers;
• Memory management;
• Virtio network driver;
• Bluetooth subsystem;
• IP tunnels definitions;
• io_uring subsystem;
• Kernel crash support code;
• Perf events;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Network traffic control;
• SCTP protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• VMware vSockets driver;
• eXpress Data Path;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• ALSA framework;
• HD-audio driver;
• AMD SoC Alsa drivers;
• WCD audio codecs;
• Intel ASoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Device frequency scaling framework;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• Hardware monitoring drivers;
• HW tracing;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• PCI Endpoint Test driver;
• VMware Balloon Driver;
• MOST (Media Oriented Systems Transport) drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Mellanox platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Mellanox drivers;
• Memory management;
• Virtio network driver;
• Bluetooth subsystem;
• IP tunnels definitions;
• io_uring subsystem;
• Kernel crash support code;
• Perf events;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Network traffic control;
• SCTP protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• VMware vSockets driver;
• eXpress Data Path;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• ALSA framework;
• HD-audio driver;
• AMD SoC Alsa drivers;
• WCD audio codecs;
• Intel ASoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Device frequency scaling framework;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• Hardware monitoring drivers;
• HW tracing;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• PCI Endpoint Test driver;
• VMware Balloon Driver;
• MOST (Media Oriented Systems Transport) drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Mellanox platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Mellanox drivers;
• Memory management;
• Virtio network driver;
• Bluetooth subsystem;
• IP tunnels definitions;
• io_uring subsystem;
• Kernel crash support code;
• Perf events;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Network traffic control;
• SCTP protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• VMware vSockets driver;
• eXpress Data Path;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• ALSA framework;
• HD-audio driver;
• AMD SoC Alsa drivers;
• WCD audio codecs;
• Intel ASoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056, CVE-2025-40057,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bus devices;
• Hardware random number generator core;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• GPU drivers;
• HW tracing;
• Input Device (Miscellaneous) drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• SCSI subsystem;
• TCM subsystem;
• Userspace I/O drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network sockets;
• XFRM subsystem;
• Control group (cgroup);
• Padata parallel execution mechanism;
• PID allocator;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• NFC subsystem;
• RF switch subsystem;
• SCTP protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Intel ASoC drivers;
• USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058, CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-68249)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bus devices;
• Hardware random number generator core;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• GPU drivers;
• HW tracing;
• Input Device (Miscellaneous) drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• SCSI subsystem;
• TCM subsystem;
• Userspace I/O drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network sockets;
• XFRM subsystem;
• Control group (cgroup);
• Padata parallel execution mechanism;
• PID allocator;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• NFC subsystem;
• RF switch subsystem;
• SCTP protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Intel ASoC drivers;
• USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058, CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-68249)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bus devices;
• Hardware random number generator core;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• GPU drivers;
• HW tracing;
• Input Device (Miscellaneous) drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• SCSI subsystem;
• TCM subsystem;
• Userspace I/O drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network sockets;
• XFRM subsystem;
• Control group (cgroup);
• Padata parallel execution mechanism;
• PID allocator;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• NFC subsystem;
• RF switch subsystem;
• SCTP protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Intel ASoC drivers;
• USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058, CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-68249)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bus devices;
• Hardware random number generator core;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• GPU drivers;
• HW tracing;
• Input Device (Miscellaneous) drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• SCSI subsystem;
• TCM subsystem;
• Userspace I/O drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network sockets;
• XFRM subsystem;
• Control group (cgroup);
• Padata parallel execution mechanism;
• PID allocator;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• NFC subsystem;
• RF switch subsystem;
• SCTP protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Intel ASoC drivers;
• USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058, CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-68249)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bus devices;
• Hardware random number generator core;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• GPU drivers;
• HW tracing;
• Input Device (Miscellaneous) drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• SCSI subsystem;
• TCM subsystem;
• Userspace I/O drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network sockets;
• XFRM subsystem;
• Control group (cgroup);
• Padata parallel execution mechanism;
• PID allocator;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• NFC subsystem;
• RF switch subsystem;
• SCTP protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Intel ASoC drivers;
• USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058, CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-68249)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bus devices;
• Hardware random number generator core;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• GPU drivers;
• HW tracing;
• Input Device (Miscellaneous) drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• SCSI subsystem;
• TCM subsystem;
• Userspace I/O drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network sockets;
• XFRM subsystem;
• Control group (cgroup);
• Padata parallel execution mechanism;
• PID allocator;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• NFC subsystem;
• RF switch subsystem;
• SCTP protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Intel ASoC drivers;
• USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058, CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-68249)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bus devices;
• Hardware random number generator core;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• GPU drivers;
• HW tracing;
• Input Device (Miscellaneous) drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• SCSI subsystem;
• TCM subsystem;
• Userspace I/O drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network sockets;
• XFRM subsystem;
• Control group (cgroup);
• Padata parallel execution mechanism;
• PID allocator;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• NFC subsystem;
• RF switch subsystem;
• SCTP protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Intel ASoC drivers;
• USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058, CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-68249)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bus devices;
• Hardware random number generator core;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• GPU drivers;
• HW tracing;
• Input Device (Miscellaneous) drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• SCSI subsystem;
• TCM subsystem;
• Userspace I/O drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network sockets;
• XFRM subsystem;
• Control group (cgroup);
• Padata parallel execution mechanism;
• PID allocator;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• NFC subsystem;
• RF switch subsystem;
• SCTP protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Intel ASoC drivers;
• USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058, CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-68249)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bus devices;
• Hardware random number generator core;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• GPU drivers;
• HW tracing;
• Input Device (Miscellaneous) drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• SCSI subsystem;
• TCM subsystem;
• Userspace I/O drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network sockets;
• XFRM subsystem;
• Control group (cgroup);
• Padata parallel execution mechanism;
• PID allocator;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• NFC subsystem;
• RF switch subsystem;
• SCTP protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Intel ASoC drivers;
• USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058, CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-68249, CVE-2025-71162)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bus devices;
• Hardware random number generator core;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• GPU drivers;
• HW tracing;
• Input Device (Miscellaneous) drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• SCSI subsystem;
• TCM subsystem;
• Userspace I/O drivers;
• USB Gadget drivers;
• USB Host Controller drivers;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network sockets;
• XFRM subsystem;
• Control group (cgroup);
• Padata parallel execution mechanism;
• PID allocator;
• Tracing infrastructure;
• Memory management;
• 9P file system network protocol;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• NFC subsystem;
• RF switch subsystem;
• SCTP protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Intel ASoC drivers;
• USB sound devices; (CVE-2024-53114, CVE-2024-56538, CVE-2024-58011, CVE-2025-21861, CVE-2025-22058, CVE-2025-23143, CVE-2025-38236, CVE-2025-38248, CVE-2025-38584, CVE-2025-39869, CVE-2025-39873, CVE-2025-39876, CVE-2025-39880, CVE-2025-39883, CVE-2025-39885, CVE-2025-39907, CVE-2025-39911, CVE-2025-39913, CVE-2025-39923, CVE-2025-39934, CVE-2025-39937, CVE-2025-39943, CVE-2025-39945, CVE-2025-39949, CVE-2025-39951, CVE-2025-39953, CVE-2025-39955, CVE-2025-39967, CVE-2025-39968, CVE-2025-39969, CVE-2025-39970, CVE-2025-39971, CVE-2025-39972, CVE-2025-39973, CVE-2025-39980, CVE-2025-39985, CVE-2025-39986, CVE-2025-39987, CVE-2025-39988, CVE-2025-39994, CVE-2025-39995, CVE-2025-39996, CVE-2025-39998, CVE-2025-40001, CVE-2025-40006, CVE-2025-40011, CVE-2025-40020, CVE-2025-40021, CVE-2025-40026, CVE-2025-40027, CVE-2025-40029, CVE-2025-40030, CVE-2025-40035, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40048, CVE-2025-40049, CVE-2025-40053, CVE-2025-40055, CVE-2025-40060, CVE-2025-40068, CVE-2025-40070, CVE-2025-40078, CVE-2025-40081, CVE-2025-40085, CVE-2025-40087, CVE-2025-40088, CVE-2025-40092, CVE-2025-40094, CVE-2025-40105, CVE-2025-40106, CVE-2025-40109, CVE-2025-40111, CVE-2025-40112, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40124, CVE-2025-40125, CVE-2025-40126, CVE-2025-40127, CVE-2025-40134, CVE-2025-40140, CVE-2025-40153, CVE-2025-40154, CVE-2025-40167, CVE-2025-40171, CVE-2025-40173, CVE-2025-40178, CVE-2025-40179, CVE-2025-40183, CVE-2025-40187, CVE-2025-40188, CVE-2025-40194, CVE-2025-40200, CVE-2025-40204, CVE-2025-40205, CVE-2025-40215, CVE-2025-40219, CVE-2025-40220, CVE-2025-40223, CVE-2025-40231, CVE-2025-40233, CVE-2025-40240, CVE-2025-40243, CVE-2025-40244, CVE-2025-40245, CVE-2025-40346, CVE-2025-40349, CVE-2025-40351, CVE-2025-68249, CVE-2025-71162)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• Device frequency scaling framework;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• Hardware monitoring drivers;
• HW tracing;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• PCI Endpoint Test driver;
• VMware Balloon Driver;
• MOST (Media Oriented Systems Transport) drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Mellanox platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Mellanox drivers;
• Memory management;
• Virtio network driver;
• Bluetooth subsystem;
• IP tunnels definitions;
• io_uring subsystem;
• Kernel crash support code;
• Perf events;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer subsystem;
• Tracing infrastructure;
• 9P file system network protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Network traffic control;
• SCTP protocol;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• TLS protocol;
• VMware vSockets driver;
• eXpress Data Path;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• ALSA framework;
• HD-audio driver;
• AMD SoC Alsa drivers;
• WCD audio codecs;
• Intel ASoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-40001, CVE-2025-40002, CVE-2025-40003, CVE-2025-40004, CVE-2025-40029, CVE-2025-40030, CVE-2025-40031, CVE-2025-40032, CVE-2025-40033, CVE-2025-40034, CVE-2025-40035, CVE-2025-40036, CVE-2025-40037, CVE-2025-40038, CVE-2025-40039, CVE-2025-40040, CVE-2025-40041, CVE-2025-40042, CVE-2025-40043, CVE-2025-40044, CVE-2025-40045, CVE-2025-40046, CVE-2025-40047, CVE-2025-40048, CVE-2025-40049, CVE-2025-40050, CVE-2025-40051, CVE-2025-40052, CVE-2025-40053, CVE-2025-40054, CVE-2025-40055, CVE-2025-40056,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Hardware random number generator core;
• Character device driver;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• ISDN/mISDN subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• NVME drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• KERNFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• Asynchronous Transfer Mode (ATM) subsystem;
• BPF subsystem;
• Mellanox drivers;
• NFS page cache wrapper;
• Memory management;
• Memory Management;
• Media input infrastructure;
• Bluetooth subsystem;
• IP tunnels definitions;
• Network traffic control;
• Rose network layer;
• Network sockets;
• io_uring subsystem;
• Control group (cgroup);
• Kernel crash support code;
• Kernel futex primitives;
• PID allocator;
• Scheduler infrastructure;
• Syscalls implementation;
• Timer…