CVE-2025-68374

In the Linux kernel, the following vulnerability has been resolved:

md: fix rcu protection in md_wakeup_thread

We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling md_wakeup_thread(). This means that the RCU pointer has been acquired before rcu_read_lock(), which renders rcu_read_lock() ineffective and could lead to a use-after-free.

Root has patched CVE-2025-68374 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved:

md: fix rcu protection in md_wakeup_thread

We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling md_wakeup_thread(). This means that the RCU pointer has been acquired before rcu_read_lock(), which renders rcu_read_lock() ineffective and could lead to a use-after-free.

In the Linux kernel, the following vulnerability has been resolved:

md: fix rcu protection in md_wakeup_thread

We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling md_wakeup_thread(). This means that the RCU pointer has been acquired before rcu_read_lock(), which renders rcu_read_lock() ineffective and could lead to a use-after-free.

In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in md_wakeup_thread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling md_wakeup_thread(). This means that the RCU pointer has been acquired before rcu_read_lock(), which renders rcu_read_lock() ineffective and could lead to a use-after-free.

These are all security issues fixed in the kernel-devel-6.18.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kernel-devel-longterm-6.18.16-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
• CVE-2026-23084: be2net: Fix NULL pointer…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (bsc#1253455).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
• CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
• CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
• CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
• CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
• CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
• CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
• CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).
• CVE-2026-23104: ice: fix devlink reload call trace…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
• CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
• CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
• CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
• CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
• CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
• CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
• CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).
• CVE-2026-23104: ice: fix devlink reload call trace…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in md_wakeup_thread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling md_wakeup_thread(). This means that the RCU pointer has been acquired before rcu_read_lock(), which renders rcu_read_lock() ineffective and could lead to a use-after-free.

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ATM drivers;
• Network block device driver;
• Bluetooth drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPIO subsystem;
• GPU drivers;
• Microsoft Hyper-V drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• UFS subsystem;
• DesignWare USB3 driver;
• USB Gadget drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• AFS file system;
• BFS file system;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• FAT file system;
• GFS2 file system;
• Journaling layer for block devices (JBD2);
• File systems infrastructure;
• Network file system (NFS) client;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• MediaTek SoC drivers;
• Bluetooth subsystem;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Timer subsystem;
• Tracing infrastructure;
• Kexec HandOver (KHO);
• Memory management;
• Ceph Core library;
• Networking core;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Open vSwitch;
• Network traffic control;
• VMware vSockets driver;
• eXpress Data Path;
• Integrity Measurement Architecture(IMA) framework;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266, CVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213, CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68221,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ATM drivers;
• Network block device driver;
• Bluetooth drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPIO subsystem;
• GPU drivers;
• Microsoft Hyper-V drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• UFS subsystem;
• DesignWare USB3 driver;
• USB Gadget drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• AFS file system;
• BFS file system;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• FAT file system;
• GFS2 file system;
• Journaling layer for block devices (JBD2);
• File systems infrastructure;
• Network file system (NFS) client;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• MediaTek SoC drivers;
• Bluetooth subsystem;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Timer subsystem;
• Tracing infrastructure;
• Kexec HandOver (KHO);
• Memory management;
• Ceph Core library;
• Networking core;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Open vSwitch;
• Network traffic control;
• VMware vSockets driver;
• eXpress Data Path;
• Integrity Measurement Architecture(IMA) framework;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266, CVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213, CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68221,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ATM drivers;
• Network block device driver;
• Bluetooth drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPIO subsystem;
• GPU drivers;
• Microsoft Hyper-V drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• UFS subsystem;
• DesignWare USB3 driver;
• USB Gadget drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• AFS file system;
• BFS file system;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• FAT file system;
• GFS2 file system;
• Journaling layer for block devices (JBD2);
• File systems infrastructure;
• Network file system (NFS) client;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• MediaTek SoC drivers;
• Bluetooth subsystem;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Timer subsystem;
• Tracing infrastructure;
• Kexec HandOver (KHO);
• Memory management;
• Ceph Core library;
• Networking core;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Open vSwitch;
• Network traffic control;
• VMware vSockets driver;
• eXpress Data Path;
• Integrity Measurement Architecture(IMA) framework;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266, CVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213, CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68221,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ATM drivers;
• Network block device driver;
• Bluetooth drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPIO subsystem;
• GPU drivers;
• Microsoft Hyper-V drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• UFS subsystem;
• DesignWare USB3 driver;
• USB Gadget drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• AFS file system;
• BFS file system;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• FAT file system;
• GFS2 file system;
• Journaling layer for block devices (JBD2);
• File systems infrastructure;
• Network file system (NFS) client;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• MediaTek SoC drivers;
• Bluetooth subsystem;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Timer subsystem;
• Tracing infrastructure;
• Kexec HandOver (KHO);
• Memory management;
• Ceph Core library;
• Networking core;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Open vSwitch;
• Network traffic control;
• VMware vSockets driver;
• eXpress Data Path;
• Integrity Measurement Architecture(IMA) framework;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266, CVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213, CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68221,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ATM drivers;
• Network block device driver;
• Bluetooth drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPIO subsystem;
• GPU drivers;
• Microsoft Hyper-V drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• UFS subsystem;
• DesignWare USB3 driver;
• USB Gadget drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• AFS file system;
• BFS file system;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• FAT file system;
• GFS2 file system;
• Journaling layer for block devices (JBD2);
• File systems infrastructure;
• Network file system (NFS) client;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• MediaTek SoC drivers;
• Bluetooth subsystem;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Timer subsystem;
• Tracing infrastructure;
• Kexec HandOver (KHO);
• Memory management;
• Ceph Core library;
• Networking core;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Open vSwitch;
• Network traffic control;
• VMware vSockets driver;
• eXpress Data Path;
• Integrity Measurement Architecture(IMA) framework;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40265, CVE-2025-40266, CVE-2025-40290, CVE-2025-40345, CVE-2025-68212, CVE-2025-68213, CVE-2025-68214, CVE-2025-68215, CVE-2025-68217, CVE-2025-68218, CVE-2025-68219, CVE-2025-68220, CVE-2025-68221,…

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ATM drivers;
• Network block device driver;
• Bluetooth drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPIO subsystem;
• GPU drivers;
• Microsoft Hyper-V drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• UFS subsystem;
• DesignWare USB3 driver;
• USB Gadget drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• AFS file system;
• BFS file system;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• FAT file system;
• GFS2 file system;
• Journaling layer for block devices (JBD2);
• File systems infrastructure;
• Network file system (NFS) client;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• MediaTek SoC drivers;
• Bluetooth subsystem;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Timer subsystem;
• Tracing infrastructure;
• Kexec HandOver (KHO);
• Memory management;
• Ceph Core library;
• Networking core;
• Devlink API;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• Open vSwitch;
• Network traffic control;
• VMware vSockets driver;
• eXpress Data Path;
• Integrity Measurement Architecture(IMA) framework;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• SoundWire (SDCA) ASoC drivers; (CVE-2025-40246, CVE-2025-40247, CVE-2025-40248, CVE-2025-40249, CVE-2025-40250, CVE-2025-40251, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40255, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40260, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40265,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• Nios II architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Xtensa architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Block device driver;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• PCCARD (PCMCIA/CardBus) bus subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PTP clock framework;
• PWM drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Virtio Host (VHOST) subsystem;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• Xen hypervisor drivers;
• AFS file system;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EFI Variable file system;
• exFAT file system;
• Ext4 file…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local attacker could use this to cause memory corruption and, theoretically, arbitrary code execution. (CVE-2026-47331)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling AppArmor AF_INET/AF_INET6 socket…