CVE-2025-71225

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

udp: Deal with race between UDP socket address change and rehash

If a UDP socket changes its local address while it's receiving datagrams, as a result of connect(), there is a period during which a lookup operation might fail to find it, after the address is changed but before the secondary hash (port and address) and the four-tuple hash (local and remote ports and addresses) are updated.

Secondary hash chains were introduced by commit 30fff9231fad ("udp: bind() optimisation") and, as a result, a rehash operation became needed to make a bound socket reachable again after a connect().

This operation was introduced by commit 719f835853a9 ("udp: add rehash on connect()") which isn't however a complete fix: the socket will be found once the rehashing completes, but not while it's pending.

This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a client sending datagrams to it. After the server receives the first datagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to the address of the sender, in order to set up a directed flow.

Now, if the client, running on a different CPU thread, happens to send a (subsequent) datagram while the server's socket changes its address, but is not rehashed yet, this will result in a failed lookup and a port unreachable error delivered to the client, as apparent from the following reproducer:

LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4)) dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in

while :; do taskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & sleep 0.1 || sleep 1 taskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null wait done

where the client will eventually get ECONNREFUSED on a write() (typically the second or third one of a given iteration):

2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused

This issue was first observed as a seldom failure in Podman's tests checking UDP functionality while using pasta(1) to connect the container's network namespace, which leads us to a reproducer with the lookup error resulting in an ICMP packet on a tap device:

LOCAL_ADDR="$(ip -j -4 addr show|jq -rM '.[] | .addr_info[0] | select(.scope == "global").local')"

while :; do ./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & sleep 0.2 || sleep 1 socat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null wait cmp tmp.in tmp.out done

Once this fails:

tmp.in tmp.out differ: char 8193, line 29

we can finally have a look at what's going on:

$ tshark -r pasta.pcap 1 0.000000 :: ? ff02::16 ICMPv6 110 Multicast Listener Report Message v2 2 0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 3 0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 4 0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 5 0.168827 c6:47:05:8d:dc:04 ? Broadcast ARP 42 Who has 88.198.0.161? Tell 88.198.0.164 6 0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55 7 0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 8 0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable) 9 0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 10 0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 11 0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096 12 0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0

On the third datagram received, the network namespace of the container initiates an ARP lookup to deliver the ICMP message.

In another…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

udp: Deal with race between UDP socket address change and rehash

If a UDP socket changes its local address while it's receiving datagrams, as a result of connect(), there is a period during which a lookup operation might fail to find it, after the address is changed but before the secondary hash (port and address) and the four-tuple hash (local and remote ports and addresses) are updated.

Secondary hash chains were introduced by commit 30fff9231fad ("udp: bind() optimisation") and, as a result, a rehash operation became needed to make a bound socket reachable again after a connect().

This operation was introduced by commit 719f835853a9 ("udp: add rehash on connect()") which isn't however a complete fix: the socket will be found once the rehashing completes, but not while it's pending.

This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a client sending datagrams to it. After the server receives the first datagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to the address of the sender, in order to set up a directed flow.

Now, if the client, running on a different CPU thread, happens to send a (subsequent) datagram while the server's socket changes its address, but is not rehashed yet, this will result in a failed lookup and a port unreachable error delivered to the client, as apparent from the following reproducer:

LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4)) dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in

while :; do taskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & sleep 0.1 || sleep 1 taskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null wait done

where the client will eventually get ECONNREFUSED on a write() (typically the second or third one of a given iteration):

2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused

This issue was first observed as a seldom failure in Podman's tests checking UDP functionality while using pasta(1) to connect the container's network namespace, which leads us to a reproducer with the lookup error resulting in an ICMP packet on a tap device:

LOCAL_ADDR="$(ip -j -4 addr show|jq -rM '.[] | .addr_info[0] | select(.scope == "global").local')"

while :; do ./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & sleep 0.2 || sleep 1 socat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null wait cmp tmp.in tmp.out done

Once this fails:

tmp.in tmp.out differ: char 8193, line 29

we can finally have a look at what's going on:

$ tshark -r pasta.pcap 1 0.000000 :: ? ff02::16 ICMPv6 110 Multicast Listener Report Message v2 2 0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 3 0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 4 0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 5 0.168827 c6:47:05:8d:dc:04 ? Broadcast ARP 42 Who has 88.198.0.161? Tell 88.198.0.164 6 0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55 7 0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 8 0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable) 9 0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 10 0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 11 0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096 12 0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0

On the third datagram received, the network namespace of the container initiates an ARP lookup to deliver the ICMP message.

In another…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

udp: Deal with race between UDP socket address change and rehash

If a UDP socket changes its local address while it's receiving datagrams, as a result of connect(), there is a period during which a lookup operation might fail to find it, after the address is changed but before the secondary hash (port and address) and the four-tuple hash (local and remote ports and addresses) are updated.

Secondary hash chains were introduced by commit 30fff9231fad ("udp: bind() optimisation") and, as a result, a rehash operation became needed to make a bound socket reachable again after a connect().

This operation was introduced by commit 719f835853a9 ("udp: add rehash on connect()") which isn't however a complete fix: the socket will be found once the rehashing completes, but not while it's pending.

This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a client sending datagrams to it. After the server receives the first datagram (cf. _xioopen_ipdgram_listen()), it issues a connect() to the address of the sender, in order to set up a directed flow.

Now, if the client, running on a different CPU thread, happens to send a (subsequent) datagram while the server's socket changes its address, but is not rehashed yet, this will result in a failed lookup and a port unreachable error delivered to the client, as apparent from the following reproducer:

LEN=$(($(cat /proc/sys/net/core/wmem_default) / 4)) dd if=/dev/urandom bs=1 count=${LEN} of=tmp.in

while :; do taskset -c 1 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & sleep 0.1 || sleep 1 taskset -c 2 socat OPEN:tmp.in UDP4:localhost:1337,shut-null wait done

where the client will eventually get ECONNREFUSED on a write() (typically the second or third one of a given iteration):

2024/11/13 21:28:23 socat[46901] E write(6, 0x556db2e3c000, 8192): Connection refused

This issue was first observed as a seldom failure in Podman's tests checking UDP functionality while using pasta(1) to connect the container's network namespace, which leads us to a reproducer with the lookup error resulting in an ICMP packet on a tap device:

LOCAL_ADDR="$(ip -j -4 addr show|jq -rM '.[] | .addr_info[0] | select(.scope == "global").local')"

while :; do ./pasta --config-net -p pasta.pcap -u 1337 socat UDP4-LISTEN:1337,null-eof OPEN:tmp.out,create,trunc & sleep 0.2 || sleep 1 socat OPEN:tmp.in UDP4:${LOCAL_ADDR}:1337,shut-null wait cmp tmp.in tmp.out done

Once this fails:

tmp.in tmp.out differ: char 8193, line 29

we can finally have a look at what's going on:

$ tshark -r pasta.pcap 1 0.000000 :: ? ff02::16 ICMPv6 110 Multicast Listener Report Message v2 2 0.168690 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 3 0.168767 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 4 0.168806 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 5 0.168827 c6:47:05:8d:dc:04 ? Broadcast ARP 42 Who has 88.198.0.161? Tell 88.198.0.164 6 0.168851 9a:55:9a:55:9a:55 ? c6:47:05:8d:dc:04 ARP 42 88.198.0.161 is at 9a:55:9a:55:9a:55 7 0.168875 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 8 0.168896 88.198.0.164 ? 88.198.0.161 ICMP 590 Destination unreachable (Port unreachable) 9 0.168926 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 10 0.168959 88.198.0.161 ? 88.198.0.164 UDP 8234 60260 ? 1337 Len=8192 11 0.168989 88.198.0.161 ? 88.198.0.164 UDP 4138 60260 ? 1337 Len=4096 12 0.169010 88.198.0.161 ? 88.198.0.164 UDP 42 60260 ? 1337 Len=0

On the third datagram received, the network namespace of the container initiates an ARP lookup to deliver the ICMP message.

In another…

Root has patched CVE-2025-71225 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2025-71225 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2025-71225 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-71225 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: md: suspend array while updating raid_disks via sysfs In raid1_reshape(), freeze_array() is called before modifying the r1bio memory pool (conf->r1bio_pool) and conf->raid_disks, and unfreeze_array() is called after the update is completed. However, freeze_array() only waits until nr_sync_pending and (nr_pending - nr_queued) of all buckets reaches zero. When an I/O error occurs, nr_queued is increased and the corresponding r1bio is queued to either retry_list or bio_end_io_list. As a result, freeze_array() may unblock before these r1bios are released. This can lead to a situation where conf->raid_disks and the mempool have already been updated while queued r1bios, allocated with the old raid_disks value, are later released. Consequently, free_r1bio() may access memory out of bounds in put_all_bios() and release r1bios of the wrong size to the new mempool, potentially causing issues with the mempool as well. Since only normal I/O might increase nr_queued while an I/O error occurs, suspending the array avoids this issue. Note: Updating raid_disks via ioctl SET_ARRAY_INFO already suspends the array. Therefore, we suspend the array when updating raid_disks via sysfs to avoid this issue too.

In the Linux kernel, the following vulnerability has been resolved:

md: suspend array while updating raid_disks via sysfs

In raid1_reshape(), freeze_array() is called before modifying the r1bio memory pool (conf->r1bio_pool) and conf->raid_disks, and unfreeze_array() is called after the update is completed.

However, freeze_array() only waits until nr_sync_pending and (nr_pending - nr_queued) of all buckets reaches zero. When an I/O error occurs, nr_queued is increased and the corresponding r1bio is queued to either retry_list or bio_end_io_list. As a result, freeze_array() may unblock before these r1bios are released.

This can lead to a situation where conf->raid_disks and the mempool have already been updated while queued r1bios, allocated with the old raid_disks value, are later released. Consequently, free_r1bio() may access memory out of bounds in put_all_bios() and release r1bios of the wrong size to the new mempool, potentially causing issues with the mempool as well.

Since only normal I/O might increase nr_queued while an I/O error occurs, suspending the array avoids this issue.

Note: Updating raid_disks via ioctl SET_ARRAY_INFO already suspends the array. Therefore, we suspend the array when updating raid_disks via sysfs to avoid this issue too.

• net: skbuff: propagate shared-frag marker through pskb_copy()
• mptcp: always handle address removal under msk socket lock {CVE-2025-21875}
• uprobes: Reject the shared zeropage in uprobe_write_opcode() {CVE-2025-21881}
• net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error {CVE-2025-21924}
• wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() {CVE-2025-21744}
• mptcp: fix NULL pointer in can_accept_new_subflow {CVE-2025-23145}
• bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock {CVE-2025-21951}
• blk-cgroup: Fix class @block_class's subsystem refcount leakage {CVE-2025-21745}
• net/mlx5: handle errors in mlx5_chains_create_table() {CVE-2025-21975}
• USB: hub: Ignore non-compliant devices with too many configs or interfaces {CVE-2025-21776}
• wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
• ice: fix memory leak in aRFS after reset {CVE-2025-21981}
• KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel {CVE-2025-21779}
• Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken {CVE-2025-38099}
• regulator: check that dummy regulator has been probed before using it {CVE-2025-22008}
• acpi: nfit: fix narrowing conversion in acpi_nfit_ctl {CVE-2025-22044}
• drm/scheduler: signal scheduled fence when kill job {CVE-2025-38436}
• nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request {CVE-2025-38430}
• net: decrease cached dst counters in dst_release {CVE-2025-22057}
• bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT {CVE-2025-38439}
• net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103}
• dlm: prevent NPD when writing a positive value to event_done {CVE-2025-23131}
• drm/amd/display: fix a Null pointer dereference vulnerability {CVE-2025-39705}
• net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree {CVE-2025-38468}
• drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params {CVE-2025-21941}
• drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities {CVE-2025-39707}
• HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
• usb: net: sierra: check for no status endpoint {CVE-2025-38474}
• drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
• wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() {CVE-2025-38643}
• netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets {CVE-2025-22063}
• vxlan: Fix NPD when refreshing an FDB entry with a nexthop object {CVE-2025-39851}
• thermal: int340x: Add NULL check for adev {CVE-2025-23136}
• Bluetooth: l2cap: Check encryption key size on incoming connection {CVE-2025-39889}
• dm thin: make get_first_thin use rcu-safe list first function {CVE-2025-21664}
• tracing: Add down_write(trace_event_sem) when adding trace event {CVE-2025-38539}
• usbnet: Fix using smp_processor_id() in preemptible code warnings {CVE-2025-40164}
• bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
• ima: Fix a potential integer overflow in ima_appraise_measurement {CVE-2022-49643}
• dm-stripe: fix a possible integer overflow {CVE-2025-39940}
• usbnet: gl620a: fix endpoint checking in genelink_bind() {CVE-2025-21877}
• fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
• usbnet: fix memory leak in error case {CVE-2022-49657}
• wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
• can: j1939: j1939_send_one(): fix missing CAN header initialization {CVE-2022-49845}
• ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
• posix-clock: Fix missing timespec64 check in pc_clock_settime() {CVE-2024-50195}
• net_sched: Prevent creation of classes with TC_H_ROOT {CVE-2025-21971}
• mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
• RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow…

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
• ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
• KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
• Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
• xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
• sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
• blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
• net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
• gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
• HID: betop: check shape of output reports {CVE-2023-53015}
• mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
• HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
• drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
• ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
• RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
• Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
• scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
• sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
• pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
• cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
• ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
• i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
• net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
• bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
• xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
• firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
• virtgpu: don't reset on shutdown {CVE-2025-38064}
• xen/netfront: fix crash when removing device {CVE-2022-48969}
• mptcp: do not fallback when OoO is present {CVE-2024-50185}
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
• xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
• ext4: fix racy may inline data check in dio write {CVE-2023-52786}
• drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
• macsec: fix UAF bug for real_dev {CVE-2022-49390}
• drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
• mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
• driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
• udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
• ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
• mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
• eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
• net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
• udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
• RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
• dlm: fix possible lkb_resource…

In the Linux kernel, the following vulnerability has been resolved:

md: suspend array while updating raid_disks via sysfs

In raid1_reshape(), freeze_array() is called before modifying the r1bio memory pool (conf->r1bio_pool) and conf->raid_disks, and unfreeze_array() is called after the update is completed.

However, freeze_array() only waits until nr_sync_pending and (nr_pending - nr_queued) of all buckets reaches zero. When an I/O error occurs, nr_queued is increased and the corresponding r1bio is queued to either retry_list or bio_end_io_list. As a result, freeze_array() may unblock before these r1bios are released.

This can lead to a situation where conf->raid_disks and the mempool have already been updated while queued r1bios, allocated with the old raid_disks value, are later released. Consequently, free_r1bio() may access memory out of bounds in put_all_bios() and release r1bios of the wrong size to the new mempool, potentially causing issues with the mempool as well.

Since only normal I/O might increase nr_queued while an I/O error occurs, suspending the array avoids this issue.

Note: Updating raid_disks via ioctl SET_ARRAY_INFO already suspends the array. Therefore, we suspend the array when updating raid_disks via sysfs to avoid this issue too.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
• CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
• CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
• CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
• CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
• CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
• CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
• CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
• CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
• CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
• CVE-2026-23084:…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
• CVE-2026-23084: be2net: Fix NULL pointer…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (bsc#1253455).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
• CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
• CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
• CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
• CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
• CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
• CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
• CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).
• CVE-2026-23104: ice: fix devlink reload call trace…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
• CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
• CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
• CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
• CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
• CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
• CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
• CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).
• CVE-2026-23104: ice: fix devlink reload call trace…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
• CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
• CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
• CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
• CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
• CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
• CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
• CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
• CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
• CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
• CVE-2026-23084:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
• CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
• CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
• CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
• CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
• CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
• CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
• CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
• CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
• CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
• CVE-2026-23084:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
• CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
• CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
• CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
• CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
• CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
• CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
• CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
• CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
• CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
• CVE-2026-23084:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
• CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
• CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
• CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
• CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
• CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
• CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
• CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
• CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
• CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
• CVE-2026-23084:…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Cryptographic API;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Cryptographic API;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Cryptographic API;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Cryptographic API;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105, CVE-2026-23107,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105, CVE-2026-23107,…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local attacker could use this to cause memory corruption and, theoretically, arbitrary code execution. (CVE-2026-47331)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of fine- grained network socket mediation. (CVE-2026-47336)

Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local attacker could use this to cause a…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local attacker could use this to cause memory corruption and, theoretically, arbitrary code execution. (CVE-2026-47331)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling AppArmor AF_INET/AF_INET6 socket…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local attacker could use this to cause memory corruption and, theoretically, arbitrary code execution. (CVE-2026-47331)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of fine- grained network socket mediation. (CVE-2026-47336)

Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local attacker could use this to cause a…