CVE-2025-71132

In the Linux kernel, the following vulnerability has been resolved: smc91x: fix broken irq-context in PREEMPT_RT When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC: [ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [ 13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106] [ 13.062137] preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mld_ifc_work [ 13.062266] C ** replaying previous printk message ** [ 13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)} [ 13.062353] Hardware name: , BIOS [ 13.062382] Workqueue: mld mld_ifc_work [ 13.062469] Call trace: [ 13.062494] show_stack+0x24/0x40 (C) [ 13.062602] __dump_stack+0x28/0x48 [ 13.062710] dump_stack_lvl+0x7c/0xb0 [ 13.062818] dump_stack+0x18/0x34 [ 13.062926] process_scheduled_works+0x294/0x450 [ 13.063043] worker_thread+0x260/0x3d8 [ 13.063124] kthread+0x1c4/0x228 [ 13.063235] ret_from_fork+0x10/0x20 This happens because smc_special_trylock() disables IRQs even on PREEMPT_RT, but smc_special_unlock() does not restore IRQs on PREEMPT_RT. The reason is that smc_special_unlock() calls spin_unlock_irqrestore(), and rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke rcu_read_unlock() through __local_bh_enable_ip() when current->softirq_disable_cnt becomes zero. To address this issue, replace smc_special_trylock() with spin_trylock_irqsave().

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: Prevent parser TCAM memory corruption

Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications.

Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means that operations must be atomic in order to, e.g., avoid spreading writes across multiple rows. Since the shadow SRAM array is used to find free rows in the hardware table, it must also be protected in order to avoid TOCTOU errors where multiple cores allocate the same row.

This issue was detected in a situation where mvpp2_set_rx_mode() ran concurrently on two CPUs. In this particular case the MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the classifier unit to drop all incoming unicast - indicated by the rx_classifier_drops counter.(CVE-2025-22060)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix NULL pointer in can_accept_new_subflow

When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL.

Call trace:

mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./net/mptcp/subflow.c:854) tcp_check_req (./net/ipv4/tcp_minisocks.c:863) tcp_v4_rcv (./net/ipv4/tcp_ipv4.c:2268) ip_protocol_deliver_rcu (./net/ipv4/ip_input.c:207) ip_local_deliver_finish (./net/ipv4/ip_input.c:234) ip_local_deliver (./net/ipv4/ip_input.c:254) ip_rcv_finish (./net/ipv4/ip_input.c:449) ...

According to the debug log, the same req received two SYN-ACK in a very short time, very likely because the client retransmits the syn ack due to multiple reasons.

Even if the packets are transmitted with a relevant time interval, they can be processed by the server on different CPUs concurrently). The 'subflow_req->msk' ownership is transferred to the subflow the first, and there will be a risk of a null pointer dereference here.

This patch fixes this issue by moving the 'subflow_req->msk' under the own_req == true conditional.

Note that the !msk check in subflow_hmac_valid() can be dropped, because the same check already exists under the own_req mpj branch where the code has been moved to.(CVE-2025-23145)

In the Linux kernel, the following vulnerability has been resolved:

mISDN: hfcpci: Fix warning when deleting uninitialized timer

With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat:

[ 250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0 [ 250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0 [ 250.218775] Modules linked in: hfcpci(-) mISDN_core [ 250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary) [ 250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0 [ 250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d [ 250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286 [ 250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95 [ 250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0 [ 250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39 [ 250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001 [ 250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8 [ 250.232454] FS: 00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000 [ 250.233851] CS: 0010 DS: 0000 ES: 0000 CR0:…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling (CVE-2024-57849)

• kernel: smc91x: fix broken irq-context in PREEMPT_RT (CVE-2025-71132)

• kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

• kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)

• kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

• kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

• kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)

• kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

• kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

• kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)

• kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)

• kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

• kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

• kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Bug Fix(es) and Enhancement(s):

• qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-8.10.z] (JIRA:Rocky Linux-193045)

• powerpc/pseries: lparcfg - fix kbuf[] underflow (JIRA:Rocky Linux-240144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling (CVE-2024-57849)

• kernel: smc91x: fix broken irq-context in PREEMPT_RT (CVE-2025-71132)

• kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)

• kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)

• kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)

• kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)

• kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)

• kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)

• kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)

• kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)

• kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)

• kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)

• kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)

• kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Bug Fix(es) and Enhancement(s):

• qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [rhel-8.10.z] (JIRA:Rocky Linux-193045)

• powerpc/pseries: lparcfg - fix kbuf[] underflow (JIRA:Rocky Linux-240144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2025-71132 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-71132 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2025-71132 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-71132 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: smc91x: fix broken irq-context in PREEMPT_RT When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC: [ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [ 13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106] [ 13.062137] preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mld_ifc_work [ 13.062266] C ** replaying previous printk message ** [ 13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)} [ 13.062353] Hardware name: , BIOS [ 13.062382] Workqueue: mld mld_ifc_work [ 13.062469] Call trace: [ 13.062494] show_stack+0x24/0x40 (C) [ 13.062602] __dump_stack+0x28/0x48 [ 13.062710] dump_stack_lvl+0x7c/0xb0 [ 13.062818] dump_stack+0x18/0x34 [ 13.062926] process_scheduled_works+0x294/0x450 [ 13.063043] worker_thread+0x260/0x3d8 [ 13.063124] kthread+0x1c4/0x228 [ 13.063235] ret_from_fork+0x10/0x20 This happens because smc_special_trylock() disables IRQs even on PREEMPT_RT, but smc_special_unlock() does not restore IRQs on PREEMPT_RT. The reason is that smc_special_unlock() calls spin_unlock_irqrestore(), and rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke rcu_read_unlock() through __local_bh_enable_ip() when current->softirq_disable_cnt becomes zero. To address this issue, replace smc_special_trylock() with spin_trylock_irqsave().

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling (CVE-2024-57849)
• kernel: smc91x: fix broken irq-context in PREEMPT_RT (CVE-2025-71132)
• kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
• kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
• kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
• kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
• kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)
• kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
• kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)
• kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
• kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)
• kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
• kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
• kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Bug Fix(es) and Enhancement(s):

• qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-8.10.z] (JIRA:AlmaLinux-193045)
• powerpc/pseries: lparcfg - fix kbuf[] underflow (JIRA:AlmaLinux-240144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling (CVE-2024-57849)
• kernel: smc91x: fix broken irq-context in PREEMPT_RT (CVE-2025-71132)
• kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970)
• kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
• kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800)
• kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397)
• kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399)
• kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392)
• kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391)
• kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018)
• kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)
• kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298)
• kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
• kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)

Bug Fix(es) and Enhancement(s):

• qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-8.10.z] (JIRA:AlmaLinux-193045)
• powerpc/pseries: lparcfg - fix kbuf[] underflow (JIRA:AlmaLinux-240144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
• tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
• mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
• cpuset: fix warning when disabling remote partition {CVE-2025-71142}
• virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
• netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
• atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
• idpf: fix error handling in the init_task on load {CVE-2026-23017}
• rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
• block: zero non-PI portion of auto integrity buffer {CVE-2026-23007}
• can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
• virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
• net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
• gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
• KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
• ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
• RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
• RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
• scsi: qla2xxx: Validate sp before freeing associated memory {CVE-2025-71236}
• net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
• drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
• iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
• net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
• can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
• Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
• ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}
• drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
• mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
• lib/buildid: use __kernel_read() for sleepable context {CVE-2026-23002}
• scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• irqchip/imx-irqsteer: Handle runtime power management correctly {CVE-2024-42290}
• io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop {CVE-2026-23113}
• net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
• net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• net: USB: Fix wrong-direction WARNING in plusb.c {CVE-2023-52742}
• module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
• udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
• net/mlx5: qos: Restrict RTNL area to avoid a lock cycle {CVE-2025-39947}
• scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• nfsd: check that server is running in unlock_filesystem {CVE-2026-22989}
• af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
• netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286} -…

Upstream kernel version 6.6.120 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.6.120 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).
• CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
• CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).
• CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).
• CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet:…

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).
• CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
• CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).
• CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).
• CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet:…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
• CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (bsc#1255260).
• CVE-2025-40355: sysfs: check visibility before changing group attribute ownership (bsc#1255261).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68171: x86/fpu: Ensure XFD state on signal delivery (bsc#1255255).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68215: ice: fix PTP cleanup on driver removal in error path (bsc#1255226).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68301: net: atlantic: fix fragment overflow handling in RX path (bsc#1255120).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68327: usb: renesas_usbhs: Fix synchronous external abort on unbind (bsc#1255488).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu (bsc#1255552).
• CVE-2025-68365: fs/ntfs3: Initialize allocated memory before use (bsc#1255548).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68727: ntfs3: Fix uninit buffer allocated by __getname() (bsc#1255568).
• CVE-2025-68728: ntfs3: fix uninit memory after failed mi_read in mi_format_new (bsc#1255539).
• CVE-2025-68733: smack: fix bug: unprivileged task can create labels (bsc#1255615).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
• CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
• CVE-2025-40271: fs/proc: fix uaf in…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise 16.0 and SL MIxro 6.2 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40147: blk-throttle: fix access race during throttle policy activation (bsc#1253344).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
• CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
• CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
• CVE-2025-40363: net: ipv6: fix field-spanning memcpy warning in AH output (bsc#1255102).
• CVE-2025-68174: amd/amdkfd: enhance kfd process check in switch partition (bsc#1255327).
• CVE-2025-68178: blk-cgroup: fix possible deadlock while configuring policy (bsc#1255266).
• CVE-2025-68188: tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() (bsc#1255269).
• CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers() (bsc#1255241).
• CVE-2025-68211: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (bsc#1255319).
• CVE-2025-68218: nvme-multipath: fix lockdep WARN due to partition scan work (bsc#1255245).
• CVE-2025-68227: mptcp: Fix proto fallback detection with BPF (bsc#1255216).
• CVE-2025-68241: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (bsc#1255157).
• CVE-2025-68245: net: netpoll: fix incorrect refcount handling causing incorrect cleanup (bsc#1255268).
• CVE-2025-68261: ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() (bsc#1255164).
• CVE-2025-68296: drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup (bsc#1255128).
• CVE-2025-68297: ceph: fix crash in process_v2_sparse_read() for encrypted directories (bsc#1255403).
• CVE-2025-68320: lan966x: Fix sleeping in atomic context (bsc#1255172).
• CVE-2025-68325: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (bsc#1255417).
• CVE-2025-68337: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted (bsc#1255482).
• CVE-2025-68341: veth: reduce XDP no_direct return section to fix race (bsc#1255506).
• CVE-2025-68348: block: fix memory leak in __blkdev_issue_zero_pages (bsc#1255694).
• CVE-2025-68349: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (bsc#1255544).
• CVE-2025-68356: gfs2: Prevent recursive memory reclaim (bsc#1255593).
• CVE-2025-68359: btrfs: fix double free of qgroup record after failure to add delayed ref head (bsc#1255542).
• CVE-2025-68360: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks (bsc#1255536).
• CVE-2025-68361: erofs: limit the level of fs stacking for file-backed mounts (bsc#1255526).
• CVE-2025-68366: nbd: defer config unlock in nbd_genl_connect (bsc#1255622).
• CVE-2025-68367: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse (bsc#1255547).
• CVE-2025-68368: md: init bioset in mddev_init (bsc#1255527).
• CVE-2025-68372: nbd: defer config put in recv_work (bsc#1255537).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68376: coresight: ETR: Fix ETR buffer use-after-free issue (bsc#1255529).
• CVE-2025-68379: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure (bsc#1255695).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68743: mshv: Fix create memory region overlap check (bsc#1255708).
• CVE-2025-68764: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags (bsc#1255930).
• CVE-2025-68768: inet: frags: add inet_frag_queue_flush() (bsc#1256579).
• CVE-2025-68770: bnxt_en: Fix XDP_TX path (bsc#1256584).
• CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
• CVE-2025-68775: net/handshake: duplicate handshake cancellations leak socket (bsc#1256665).
• CVE-2025-68776: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() (bsc#1256659). -…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• Network traffic control;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• SCTP protocol;
• Network sockets;
• Sun RPC protocol;
• TIPC protocol;
• VMware vSockets driver;
• Wireless networking;
• Rust bindings mechanism;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices; (CVE-2022-49465, CVE-2024-36903, CVE-2024-36927, CVE-2024-37354, CVE-2024-41014, CVE-2024-46830, CVE-2024-47666, CVE-2024-49968, CVE-2025-22022, CVE-2025-22111, CVE-2025-22121, CVE-2025-38022, CVE-2025-38129, CVE-2025-38556, CVE-2025-40040, CVE-2025-40083, CVE-2025-40110, CVE-2025-40211, CVE-2025-40248, CVE-2025-40252, CVE-2025-40253, CVE-2025-40254, CVE-2025-40257, CVE-2025-40258, CVE-2025-40259, CVE-2025-40261, CVE-2025-40262, CVE-2025-40263, CVE-2025-40264, CVE-2025-40269, CVE-2025-40271, CVE-2025-40272, CVE-2025-40273, CVE-2025-40275, CVE-2025-40277, CVE-2025-40278, CVE-2025-40279, CVE-2025-40280, CVE-2025-40281, CVE-2025-40282, CVE-2025-40283, CVE-2025-40304, CVE-2025-40306, CVE-2025-40308, CVE-2025-40309, CVE-2025-40312, CVE-2025-40313, CVE-2025-40314, CVE-2025-40315, CVE-2025-40317,…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Nios II architecture;
• PowerPC architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network traffic control;
• Network sockets;
• XFRM subsystem;
• io_uring subsystem;
• Control group (cgroup);
• Locking primitives;
• Padata parallel execution mechanism;
• PID allocator;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• RF switch subsystem;
• Rose network layer;
• SCTP protocol;
• Sun…

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Nios II architecture;
• PowerPC architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network traffic control;
• Network sockets;
• XFRM subsystem;
• io_uring subsystem;
• Control group (cgroup);
• Locking primitives;
• Padata parallel execution mechanism;
• PID allocator;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem; …

Qualys discovered that several vulnerabilities existed in the AppArmor Linux kernel Security Module (LSM). An unprivileged local attacker could use these issues to load, replace, and remove arbitrary AppArmor profiles causing denial of service, exposure of sensitive information (kernel memory), local privilege escalation, or possibly escape a container. (LP: #2143853, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Nios II architecture;
• PowerPC architecture;
• Sun Sparc architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Network block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• DMA engine subsystem;
• Intel Stratix 10 firmware drivers;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Tablet) drivers;
• ISDN/mISDN subsystem;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• ARM PM domains;
• PPS (Pulse Per Second) driver;
• PWM drivers;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Userspace I/O drivers;
• Cadence USB3 driver;
• DesignWare USB3 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Renesas USBHS Controller drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Framebuffer layer;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS file system;
• HFS+ file system;
• HugeTLB file system;
• Journaling layer for block devices (JBD2);
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• Proc file system;
• SMB network file system;
• SquashFS file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• Ethernet bridge;
• Memory management;
• padata parallel execution mechanism;
• IP tunnels definitions;
• Network traffic control;
• Network sockets;
• XFRM subsystem;
• io_uring subsystem;
• Control group (cgroup);
• Locking primitives;
• Padata parallel execution mechanism;
• PID allocator;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• 9P file system network protocol;
• Bluetooth subsystem;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem; …

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• GPU drivers;
• Hardware monitoring drivers;
• Intel Trace Hub HW tracing drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• SCSI subsystem;
• SPI subsystem;
• TCM subsystem;
• Freescale USB OTG Transceiver Driver;
• USB Type-C Connector System Software Interface driver;
• Watchdog drivers;
• BTRFS file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• User-space API (UAPI);
• io_uring subsystem;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• BPF subsystem;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Sun RPC protocol;
• Key management;
• Landlock security;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-68351, CVE-2025-68353, CVE-2025-68365, CVE-2025-68368, CVE-2025-68725, CVE-2025-68736, CVE-2025-68745, CVE-2025-68767, CVE-2025-68768, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68781, CVE-2025-68782, CVE-2025-68783, CVE-2025-68784, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68791, CVE-2025-68792, CVE-2025-68793, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68802, CVE-2025-68803, CVE-2025-68804, CVE-2025-68805, CVE-2025-68806, CVE-2025-68807, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-68822, CVE-2025-68823, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71070, CVE-2025-71071, CVE-2025-71072, CVE-2025-71073, CVE-2025-71075, CVE-2025-71076, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71080, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71099, CVE-2025-71100, CVE-2025-71101,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• GPU drivers;
• Hardware monitoring drivers;
• Intel Trace Hub HW tracing drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• SCSI subsystem;
• SPI subsystem;
• TCM subsystem;
• Freescale USB OTG Transceiver Driver;
• USB Type-C Connector System Software Interface driver;
• Watchdog drivers;
• BTRFS file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• User-space API (UAPI);
• io_uring subsystem;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• BPF subsystem;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Sun RPC protocol;
• Key management;
• Landlock security;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-68351, CVE-2025-68353, CVE-2025-68365, CVE-2025-68368, CVE-2025-68725, CVE-2025-68736, CVE-2025-68745, CVE-2025-68767, CVE-2025-68768, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68781, CVE-2025-68782, CVE-2025-68783, CVE-2025-68784, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68791, CVE-2025-68792, CVE-2025-68793, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68802, CVE-2025-68803, CVE-2025-68804, CVE-2025-68805, CVE-2025-68806, CVE-2025-68807, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-68822, CVE-2025-68823, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71070, CVE-2025-71071, CVE-2025-71072, CVE-2025-71073, CVE-2025-71075, CVE-2025-71076, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71080, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71099, CVE-2025-71100, CVE-2025-71101,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Network block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Hardware crypto device drivers;
• GPU drivers;
• Hardware monitoring drivers;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Macintosh device drivers;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• NVME drivers;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Voltage and Current Regulator drivers;
• SCSI subsystem;
• SPI subsystem;
• Media Oriented Systems Transport (MOST) driver;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• USB Host Controller drivers;
• USB Type-C Connector System Software Interface driver;
• Backlight driver;
• Watchdog drivers;
• BFS file system;
• BTRFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• BPF subsystem;
• Ethernet bridge;
• io_uring subsystem;
• Locking primitives;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Network sockets;
• Sun RPC protocol;
• Integrity Measurement Architecture(IMA) framework;
• Key management;
• Simplified Mandatory Access Control Kernel framework;
• FireWire sound drivers;
• HD-audio driver;
• Turtle Beach Wavefront ALSA driver;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-57795, CVE-2025-22022, CVE-2025-22111, CVE-2025-38022, CVE-2025-38234, CVE-2025-40164, CVE-2025-40325, CVE-2025-68206, CVE-2025-68254, CVE-2025-68255, CVE-2025-68256, CVE-2025-68257, CVE-2025-68258, CVE-2025-68259, CVE-2025-68261, CVE-2025-68263, CVE-2025-68264, CVE-2025-68265, CVE-2025-68266, CVE-2025-68291, CVE-2025-68325, CVE-2025-68332, CVE-2025-68335, CVE-2025-68336, CVE-2025-68337, CVE-2025-68344, CVE-2025-68345, CVE-2025-68346, CVE-2025-68347, CVE-2025-68349, CVE-2025-68354, CVE-2025-68362, CVE-2025-68363, CVE-2025-68364, CVE-2025-68366, CVE-2025-68367, CVE-2025-68369, CVE-2025-68371, CVE-2025-68372, CVE-2025-68374, CVE-2025-68378, CVE-2025-68379, CVE-2025-68380, CVE-2025-68724, CVE-2025-68727, CVE-2025-68728, CVE-2025-68732, CVE-2025-68733, CVE-2025-68740, CVE-2025-68741, CVE-2025-68742, CVE-2025-68744, CVE-2025-68746, CVE-2025-68753, CVE-2025-68755, CVE-2025-68756, CVE-2025-68757, CVE-2025-68758, CVE-2025-68759, CVE-2025-68763, CVE-2025-68764, CVE-2025-68765, CVE-2025-68766, CVE-2025-68767,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• GPU drivers;
• Hardware monitoring drivers;
• Intel Trace Hub HW tracing drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• SCSI subsystem;
• SPI subsystem;
• TCM subsystem;
• Freescale USB OTG Transceiver Driver;
• USB Type-C Connector System Software Interface driver;
• Watchdog drivers;
• BTRFS file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• User-space API (UAPI);
• io_uring subsystem;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• BPF subsystem;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Sun RPC protocol;
• Key management;
• Landlock security;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-68351, CVE-2025-68353, CVE-2025-68365, CVE-2025-68368, CVE-2025-68725, CVE-2025-68736, CVE-2025-68745, CVE-2025-68767, CVE-2025-68768, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68781, CVE-2025-68782, CVE-2025-68783, CVE-2025-68784, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68791, CVE-2025-68792, CVE-2025-68793, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68802, CVE-2025-68803, CVE-2025-68804, CVE-2025-68805, CVE-2025-68806, CVE-2025-68807, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-68822, CVE-2025-68823, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71070, CVE-2025-71071, CVE-2025-71072, CVE-2025-71073, CVE-2025-71075, CVE-2025-71076, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71099, CVE-2025-71100, CVE-2025-71101, CVE-2025-71102,…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• MIPS architecture;
• PowerPC architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• GPU drivers;
• Hardware monitoring drivers;
• Intel Trace Hub HW tracing drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• PA-RISC drivers;
• Chrome hardware platform drivers;
• x86 platform drivers;
• SCSI subsystem;
• SPI subsystem;
• TCM subsystem;
• Freescale USB OTG Transceiver Driver;
• USB Type-C Connector System Software Interface driver;
• Watchdog drivers;
• BTRFS file system;
• exFAT file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• File systems infrastructure;
• Network file system (NFS) server daemon;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• XFS file system;
• User-space API (UAPI);
• io_uring subsystem;
• Scheduler infrastructure;
• Shadow Call Stack mechanism;
• Tracing infrastructure;
• Memory management;
• BPF subsystem;
• CAIF protocol;
• Ceph Core library;
• Networking core;
• Ethtool driver;
• Handshake API;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Rose network layer;
• Network traffic control;
• Sun RPC protocol;
• Key management;
• Landlock security;
• STMicroelectronics SoC drivers;
• USB sound devices;
• KVM subsystem; (CVE-2025-68351, CVE-2025-68353, CVE-2025-68365, CVE-2025-68368, CVE-2025-68725, CVE-2025-68736, CVE-2025-68745, CVE-2025-68767, CVE-2025-68768, CVE-2025-68769, CVE-2025-68770, CVE-2025-68771, CVE-2025-68772, CVE-2025-68773, CVE-2025-68774, CVE-2025-68775, CVE-2025-68776, CVE-2025-68777, CVE-2025-68778, CVE-2025-68780, CVE-2025-68781, CVE-2025-68782, CVE-2025-68783, CVE-2025-68784, CVE-2025-68785, CVE-2025-68786, CVE-2025-68787, CVE-2025-68788, CVE-2025-68791, CVE-2025-68792, CVE-2025-68793, CVE-2025-68794, CVE-2025-68795, CVE-2025-68796, CVE-2025-68797, CVE-2025-68798, CVE-2025-68799, CVE-2025-68800, CVE-2025-68801, CVE-2025-68802, CVE-2025-68803, CVE-2025-68804, CVE-2025-68805, CVE-2025-68806, CVE-2025-68807, CVE-2025-68808, CVE-2025-68809, CVE-2025-68810, CVE-2025-68811, CVE-2025-68813, CVE-2025-68814, CVE-2025-68815, CVE-2025-68816, CVE-2025-68817, CVE-2025-68818, CVE-2025-68819, CVE-2025-68820, CVE-2025-68821, CVE-2025-68822, CVE-2025-68823, CVE-2025-71064, CVE-2025-71065, CVE-2025-71066, CVE-2025-71067, CVE-2025-71068, CVE-2025-71069, CVE-2025-71070, CVE-2025-71071, CVE-2025-71072, CVE-2025-71073, CVE-2025-71075, CVE-2025-71076, CVE-2025-71077, CVE-2025-71078, CVE-2025-71079, CVE-2025-71081, CVE-2025-71082, CVE-2025-71083, CVE-2025-71084, CVE-2025-71085, CVE-2025-71086, CVE-2025-71087, CVE-2025-71089, CVE-2025-71091, CVE-2025-71093, CVE-2025-71094, CVE-2025-71095, CVE-2025-71096, CVE-2025-71097, CVE-2025-71098, CVE-2025-71099, CVE-2025-71100, CVE-2025-71101, CVE-2025-71102,…