CVE-2025-71098

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: Prevent parser TCAM memory corruption

Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications.

Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means that operations must be atomic in order to, e.g., avoid spreading writes across multiple rows. Since the shadow SRAM array is used to find free rows in the hardware table, it must also be protected in order to avoid TOCTOU errors where multiple cores allocate the same row.

This issue was detected in a situation where mvpp2_set_rx_mode() ran concurrently on two CPUs. In this particular case the MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the classifier unit to drop all incoming unicast - indicated by the rx_classifier_drops counter.(CVE-2025-22060)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix NULL pointer in can_accept_new_subflow

When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL.

Call trace:

mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./net/mptcp/subflow.c:854) tcp_check_req (./net/ipv4/tcp_minisocks.c:863) tcp_v4_rcv (./net/ipv4/tcp_ipv4.c:2268) ip_protocol_deliver_rcu (./net/ipv4/ip_input.c:207) ip_local_deliver_finish (./net/ipv4/ip_input.c:234) ip_local_deliver (./net/ipv4/ip_input.c:254) ip_rcv_finish (./net/ipv4/ip_input.c:449) ...

According to the debug log, the same req received two SYN-ACK in a very short time, very likely because the client retransmits the syn ack due to multiple reasons.

Even if the packets are transmitted with a relevant time interval, they can be processed by the server on different CPUs concurrently). The 'subflow_req->msk' ownership is transferred to the subflow the first, and there will be a risk of a null pointer dereference here.

This patch fixes this issue by moving the 'subflow_req->msk' under the own_req == true conditional.

Note that the !msk check in subflow_hmac_valid() can be dropped, because the same check already exists under the own_req mpj branch where the code has been moved to.(CVE-2025-23145)

In the Linux kernel, the following vulnerability has been resolved:

mISDN: hfcpci: Fix warning when deleting uninitialized timer

With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat:

[ 250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0 [ 250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0 [ 250.218775] Modules linked in: hfcpci(-) mISDN_core [ 250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary) [ 250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0 [ 250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d [ 250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286 [ 250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95 [ 250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0 [ 250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39 [ 250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001 [ 250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8 [ 250.232454] FS: 00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000 [ 250.233851] CS: 0010 DS: 0000 ES: 0000 CR0:…

Root has patched CVE-2025-71098 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-71098 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-71098 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-71098 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: make ip6gre_header() robust Over the years, syzbot found many ways to crash the kernel in ip6gre_header() [1]. This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ip6gre device. [1] skbuff: skb_under_panic: text:ffffffff8a1d69a8 len:136 put:40 head:ffff888059bc7000 data:ffff888059bc6fe8 tail:0x70 end:0x6c0 dev:team0 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:213 ! <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ip6gre_header+0xc8/0x790 net/ipv6/ip6_gre.c:1371 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 neigh_output include/net/neighbour.h:556 [inline] ip6_finish_output2+0xfb3/0x1480 net/ipv6/ip6_output.c:136 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline] ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:220 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693

• smb: client: reject userspace cifs.spnego descriptions
• usb: ulpi: fix memory leak on ulpi_register() error paths
• usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
• mptcp: consolidate suboption status {CVE-2025-21707}
• blktrace: fix __this_cpu_read/write in preemptible context {CVE-2026-23374}
• espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097}
• net: usb: asix: validate PHY address before use {CVE-2025-71094}
• driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
• net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997}
• crypto: af_alg - Set merge to zero early in af_alg_sendmsg {CVE-2025-39931}
• bonding: fix use-after-free due to enslave fail after slave array update {CVE-2026-23171}
• Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT {CVE-2025-38335}
• spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485}
• mm/smaps: fix race between smaps_hugetlb_range and migration {CVE-2025-39754}
• vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
• mm/userfaultfd: fix hugetlb fault mutex hash calculation {CVE-2026-31575}
• RDMA/irdma: Initialize free_qp completion before using it {CVE-2026-31492}
• calipso: Don't call calipso functions for AF_INET sk. {CVE-2025-38147}
• mm/ksm: fix flag-dropping behavior in ksm_madvise {CVE-2025-40040}
• espintcp: fix skb leaks {CVE-2025-38057}
• net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize {CVE-2023-53667}
• memcg: fix soft lockup in the OOM process {CVE-2024-57977}
• futex: Clear stale exiting pointer in futex_lock_pi() retry path {CVE-2026-31555}
• trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005}
• dm-verity: disable recursive forward error correction {CVE-2025-71161}
• Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395}
• vfs: Don't evict inode under the inode lru traversing context {CVE-2024-45003}
• ipvs: fix uninit-value for saddr in do_output_route4 {CVE-2025-37961}
• sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
• net: phy: leds: fix memory leak {CVE-2025-37989}
• x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper {CVE-2025-39681}
• tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
• netfilter: ctnetlink: remove refcounting in expectation dumpers {CVE-2025-39764}
• sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
• kobject: Add sanity check for kset->kobj.ktype in kset_register() {CVE-2023-53480}
• io_uring: check if iowq is killed before queuing {CVE-2024-56709}
• netfilter: x_tables: fix percpu counter block leak on error path when creating new netns {CVE-2023-53200}
• ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed {CVE-2023-53481}
• udf: Do not update file length for failed writes to inline files {CVE-2023-53295}
• bpf: Forget ranges when refining tnum after JSET {CVE-2025-39748}
• perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• misc: vmw_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-53279}
• can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write {CVE-2023-53344}
• tracing: Fix race issue between cpu buffer write and swap {CVE-2023-53368}
• KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses {CVE-2025-23141}
• io_uring/tctx: work around xa_store() allocation error issue {CVE-2024-56584}
• objtool: Fix memory leak in create_static_call_sections() {CVE-2023-53423}
• net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• PM: EM: fix memory leak with using debugfs_lookup() {CVE-2023-53411}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• watchdog: Fix kmemleak in watchdog_cdev_register {CVE-2023-53234} -…

• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ALSA: usb-audio: Use the right limit for PCM OOB check
• ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
• cpufreq: governor: Free dbs_data directly when gov->init() fails {CVE-2026-43328}
• rcu: Fix rcu_read_unlock() deadloop due to softirq
• rcu: Fix racy re-initialization of irq_work causing hangs
• RDMA/efa: Fix possible deadlock {CVE-2026-31493}
• RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493}
• RDMA/efa: Improve admin completion context state machine {CVE-2026-31493}
• RDMA/efa: Check stored completion CTX command ID with received one {CVE-2026-31493}
• RDMA/efa: Extend admin timeout error print
• RDMA/efa: Properly handle unexpected AQ completions {CVE-2026-31493}
• rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• rtnetlink: Allocate vfinfo size for VF GUIDs when supported {CVE-2025-22075}
• kernel/printk/index.c: fix memory leak with using debugfs_lookup() {CVE-2023-53402}
• wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
• md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() {CVE-2023-53210}
• exfat: fix the infinite loop in exfat_readdir() {CVE-2024-57940}
• af_netlink: Fix shift out of bounds in group mask calculation {CVE-2022-49197}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
• efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}
• kernel/resource: fix kfree() of bootmem memory again {CVE-2022-49190}
• smb: client: fix warning in cifs_smb3_do_mount() {CVE-2023-53230}
• sctp: Fix null-ptr-deref in reuseport_add_sock(). {CVE-2024-44935}
• RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages {CVE-2024-50208}
• drm/amdgpu: avoid using null object of framebuffer {CVE-2024-41093}
• firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
• ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738}
• net: hinic: fix memory leak when reading function table {CVE-2022-50438}
• device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() {CVE-2022-49752}
• libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232}
• usbnet: fix memory leak in error case {CVE-2022-49657}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• seccomp: Move copy_seccomp() to no failure path. {CVE-2022-50661}
• net/mlx5: fs, lock FTE when checking if active {CVE-2024-53121}
• nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756}
• leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587}
• bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener {CVE-2023-52986}
• RDMA/uverbs: Prevent integer overflow issue {CVE-2024-57890}
• sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125}
• tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() {CVE-2022-49800}
• kprobes: Fix check for probe enabled in kill_kprobe() {CVE-2022-50266}
• NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 {CVE-2024-26870}
• i915/perf: Fix NULL deref bugs with drm_dbg() calls {CVE-2023-52788}
• can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357}
• regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode {CVE-2022-50558}
• wifi: cfg80211: Set correct chandef when starting CAC {CVE-2024-49937}
• netfilter: nf_tables: prevent nf_skb_duplicated corruption {CVE-2024-49952}
• can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830}
• bpf: Fix…

In the Linux kernel, the following vulnerability has been resolved:

ip6_gre: make ip6gre_header() robust

Over the years, syzbot found many ways to crash the kernel in ip6gre_header() [1].

This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len

In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ip6gre device.

[1] skbuff: skb_under_panic: text:ffffffff8a1d69a8 len:136 put:40 head:ffff888059bc7000 data:ffff888059bc6fe8 tail:0x70 end:0x6c0 dev:team0 ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:213 ! <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ip6gre_header+0xc8/0x790 net/ipv6/ip6_gre.c:1371 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 neigh_output include/net/neighbour.h:556 [inline] ip6_finish_output2+0xfb3/0x1480 net/ipv6/ip6_output.c:136 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline] ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:220 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693

Upstream kernel version 6.6.120 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.6.120 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).
• CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
• CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).
• CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).
• CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet:…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).
• CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
• CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).
• CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).
• CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50347: mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() (bsc#1249928).
• CVE-2022-50580: blk-throttle: prevent overflow while calculating wait time (bsc#1252542).
• CVE-2022-50676: net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() (bsc#1254689).
• CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
• CVE-2022-50709: wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() (bsc#1255565).
• CVE-2022-50716: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out (bsc#1255839).
• CVE-2022-50717: nvmet-tcp: add bounds check on Transfer Tag (bsc#1255844).
• CVE-2022-50719: ALSA: line6: fix stack overflow in line6_midi_transmit (bsc#1255939).
• CVE-2022-50740: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() (bsc#1256155).
• CVE-2022-50744: scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs (bsc#1256165).
• CVE-2022-50749: acct: fix potential integer overflow in encode_comp_t() (bsc#1256191).
• CVE-2022-50751: configfs: fix possible memory leak in configfs_create_dir() (bsc#1256184).
• CVE-2022-50760: drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() (bsc#1255983).
• CVE-2022-50770: ocfs2: fix memory leak in ocfs2_mount_volume() (bsc#1256221).
• CVE-2022-50777: net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe (bsc#1256320).
• CVE-2022-50780: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed (bsc#1256305).
• CVE-2022-50782: ext4: fix bug_on in __es_tree_search caused by bad quota inode (bsc#1256282).
• CVE-2022-50786: media: s5p-mfc: Clear workbit to handle error condition (bsc#1256258).
• CVE-2022-50816: ipv6: ensure sane device mtu in tunnels (bsc#1256038).
• CVE-2022-50834: nfc: Fix potential resource leaks (bsc#1256219).
• CVE-2022-50865: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() (bsc#1256168).
• CVE-2022-50868: hwrng: amd - Fix PCI device refcount leak (bsc#1256386).
• CVE-2022-50880: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() (bsc#1256132).
• CVE-2022-50881: ath9k: Fix typo in function name (bsc#1256130).
• CVE-2022-50884: drm: Prevent drm_copy_field() to attempt copying a NULL pointer (bsc#1256127).
• CVE-2022-50885: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed (bsc#1256122).
• CVE-2022-50887: regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() (bsc#1256125).
• CVE-2023-50756: nvme-pci: fix mempool alloc size (bsc#1256216).
• CVE-2023-53685: tun: Fix memory leak for detached NAPI queue (bsc#1251770).
• CVE-2023-53747: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF (bsc#1254572).
• CVE-2023-53751: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (bsc#1254986).
• CVE-2023-53825: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg() (bsc#1254707).
• CVE-2023-53853: netlink: annotate accesses to nlk->cb_running (bsc#1254673).
• CVE-2023-53863: netlink: do not hard code device address lenth in fdb dumps (bsc#1254657).
• CVE-2023-53992: wifi: cfg80211: ocb: don't leave if not joined (bsc#1256058).
• CVE-2023-54012: net: fix stack overflow when LRO is disabled for virtual interfaces (bsc#1255571).
• CVE-2023-54047: drm/rockchip: dw_hdmi: cleanup drm encoder during unbind (bsc#1256398).
• CVE-2023-54048: RDMA/bnxt_re: Prevent handling any completions after qp destroy (bsc#1256395).
• CVE-2023-54067: btrfs: fix race when deleting free space root from the dirty cow roots list (bsc#1256369).
• CVE-2023-54111: pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups (bsc#1256149).
• CVE-2023-54112: kcm: Fix memory leak in error path of kcm_sendmsg() (bsc#1256354).
• CVE-2023-54118: serial: sc16is7xx: setup GPIO controller later in probe…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).
• CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
• CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).
• CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).
• CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40304, CVE-2025-40306, CVE-2025-40308, CVE-2025-40309, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• PowerPC architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network traffic control;
• Network sockets;
• XFRM subsystem;
• io_uring subsystem;
• Control group (cgroup);
• Locking primitives;
• Padata parallel execution mechanism;
• PID allocator;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• RF switch subsystem;
• Rose network layer;
• SCTP protocol;
• Sun…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Nios II architecture;
• PowerPC architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network traffic control;
• Network sockets;
• XFRM subsystem;
• io_uring subsystem;
• Control group (cgroup);
• Locking primitives;
• Padata parallel execution mechanism;
• PID allocator;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem; …

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Nios II architecture;
• PowerPC architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network traffic control;
• Network sockets;
• XFRM subsystem;
• io_uring subsystem;
• Control group (cgroup);
• Locking primitives;
• Padata parallel execution mechanism;
• PID allocator;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem; …

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• GPU drivers;
• Hardware monitoring drivers;
• Intel Trace Hub HW tracing drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• SCSI subsystem;
• SPI subsystem;
• TCM subsystem;
• Freescale USB OTG Transceiver Driver;
• USB Type-C Connector System Software Interface driver;
• Watchdog drivers;
• BTRFS file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• User-space API (UAPI);
• io_uring subsystem;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• BPF subsystem;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Sun RPC protocol;
• Key management;
• Landlock security;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-68351, CVE-2025-68353, CVE-2025-68365, CVE-2025-68368, CVE-2025-68725, CVE-2025-68736, CVE-2025-68745, CVE-2025-68767, CVE-2025-68768, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68781, CVE-2025-68782, CVE-2025-68783, CVE-2025-68784, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68791, CVE-2025-68792, CVE-2025-68793, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68802, CVE-2025-68803, CVE-2025-68804, CVE-2025-68805, CVE-2025-68806, CVE-2025-68807, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-68822, CVE-2025-68823, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71070, CVE-2025-71071, CVE-2025-71072, CVE-2025-71073, CVE-2025-71075, CVE-2025-71076, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71080, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71099, CVE-2025-71100, CVE-2025-71101,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• GPU drivers;
• Hardware monitoring drivers;
• Intel Trace Hub HW tracing drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• SCSI subsystem;
• SPI subsystem;
• TCM subsystem;
• Freescale USB OTG Transceiver Driver;
• USB Type-C Connector System Software Interface driver;
• Watchdog drivers;
• BTRFS file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• User-space API (UAPI);
• io_uring subsystem;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• BPF subsystem;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Sun RPC protocol;
• Key management;
• Landlock security;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-68351, CVE-2025-68353, CVE-2025-68365, CVE-2025-68368, CVE-2025-68725, CVE-2025-68736, CVE-2025-68745, CVE-2025-68767, CVE-2025-68768, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68781, CVE-2025-68782, CVE-2025-68783, CVE-2025-68784, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68791, CVE-2025-68792, CVE-2025-68793, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68802, CVE-2025-68803, CVE-2025-68804, CVE-2025-68805, CVE-2025-68806, CVE-2025-68807, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-68822, CVE-2025-68823, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71070, CVE-2025-71071, CVE-2025-71072, CVE-2025-71073, CVE-2025-71075, CVE-2025-71076, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71080, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71099, CVE-2025-71100, CVE-2025-71101,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• GPU drivers;
• Hardware monitoring drivers;
• Intel Trace Hub HW tracing drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• SCSI subsystem;
• SPI subsystem;
• TCM subsystem;
• Freescale USB OTG Transceiver Driver;
• USB Type-C Connector System Software Interface driver;
• Watchdog drivers;
• BTRFS file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• User-space API (UAPI);
• io_uring subsystem;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• BPF subsystem;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Sun RPC protocol;
• Key management;
• Landlock security;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-68351, CVE-2025-68353, CVE-2025-68365, CVE-2025-68368, CVE-2025-68725, CVE-2025-68736, CVE-2025-68745, CVE-2025-68767, CVE-2025-68768, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68781, CVE-2025-68782, CVE-2025-68783, CVE-2025-68784, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68791, CVE-2025-68792, CVE-2025-68793, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68802, CVE-2025-68803, CVE-2025-68804, CVE-2025-68805, CVE-2025-68806, CVE-2025-68807, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-68822, CVE-2025-68823, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71070, CVE-2025-71071, CVE-2025-71072, CVE-2025-71073, CVE-2025-71075, CVE-2025-71076, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71099, CVE-2025-71100, CVE-2025-71101, CVE-2025-71102,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• GPU drivers;
• Hardware monitoring drivers;
• Intel Trace Hub HW tracing drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• SCSI subsystem;
• SPI subsystem;
• TCM subsystem;
• Freescale USB OTG Transceiver Driver;
• USB Type-C Connector System Software Interface driver;
• Watchdog drivers;
• BTRFS file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• User-space API (UAPI);
• io_uring subsystem;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• BPF subsystem;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Sun RPC protocol;
• Key management;
• Landlock security;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-68351, CVE-2025-68353, CVE-2025-68365, CVE-2025-68368, CVE-2025-68725, CVE-2025-68736, CVE-2025-68745, CVE-2025-68767, CVE-2025-68768, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68781, CVE-2025-68782, CVE-2025-68783, CVE-2025-68784, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68791, CVE-2025-68792, CVE-2025-68793, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68802, CVE-2025-68803, CVE-2025-68804, CVE-2025-68805, CVE-2025-68806, CVE-2025-68807, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-68822, CVE-2025-68823, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71070, CVE-2025-71071, CVE-2025-71072, CVE-2025-71073, CVE-2025-71075, CVE-2025-71076, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71099, CVE-2025-71100, CVE-2025-71101, CVE-2025-71102,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767, CVE-2025-68769,…