CVE-2026-23105

In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq. use cl_is_active instead of relying on the child qdisc's qlen to determine class activation.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

iommu/s390: Implement blocking domain

This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug __iommu_group_set_domain_nofail() attaching the default domain fails when the platform no longer recognizes the device as it has already been removed and we end up with a NULL domain pointer and UAF. This is exactly the case referred to in the second comment in __iommu_device_set_domain() and just as stated there if we can instead attach the blocking domain the UAF is prevented as this can handle the already removed device. Implement the blocking domain to use this handling. With this change, the crash is fixed but we still hit a warning attempting to change DMA ownership on a blocked device.(CVE-2024-53232)

In the Linux kernel, the following vulnerability has been resolved:

iommu: Fix two issues in iommu_copy_struct_from_user()

In the review for iommu_copy_struct_to_user() helper, Matt pointed out that a NULL pointer should be rejected prior to dereferencing it: https://lore.kernel.org/all/(CVE-2025-37900)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: Avoid race in open_cached_dir with lease breaks

A pre-existing valid cfid returned from find_or_create_cached_dir might race with a lease break, meaning open_cached_dir doesn't consider it valid, and thinks it's newly-constructed. This leaks a dentry reference if the allocation occurs before the queued lease break work runs.

Avoid the race by extending holding the cfid_list_lock across find_or_create_cached_dir and when the result is checked.(CVE-2025-37954)

In the Linux kernel, the following vulnerability has been resolved:

net_sched: prio: fix a race in prio_tune()

Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time.

The race is as follows:

CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put()

This can be abused to underflow a parent's qlen.

Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.(CVE-2025-38083)

In the Linux kernel, the following vulnerability has been resolved:

IB/mlx5: Fix potential deadlock in MR deregistration

The issue arises when kzalloc() is invoked while holding umem_mutex or any other lock acquired under umem_mutex. This is problematic because kzalloc() can trigger fs_reclaim_aqcuire(), which may, in turn, invoke mmu_notifier_invalidate_range_start(). This function can lead to mlx5_ib_invalidate_range(), which attempts to acquire umem_mutex again, resulting in a deadlock.

The problematic flow: CPU0 | CPU1 ---------------------------------------|------------------------------------------------ mlx5_ib_dereg_mr() | → revoke_mr() | → mutex_lock(&umem_odp->umem_mutex) | | mlx5_mkey_cache_init() | → mutex_lock(&dev->cache.rb_lock) | → mlx5r_cache_create_ent_locked() | → kzalloc(GFP_KERNEL) | → fs_reclaim() | → mmu_notifier_invalidate_range_start() | → mlx5_ib_invalidate_range() | → mutex_lock(&umem_odp->umem_mutex) →…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency

Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it.(CVE-2025-68817)

In the Linux kernel, the following vulnerability has been resolved:

tpm: Cap the number of PCR banks

tpm2_get_pcr_allocation() does not cap any upper limit for the number of banks. Cap the limit to eight banks so that out of bounds values coming from external I/O cause on only limited harm.(CVE-2025-71077)

In the Linux kernel, the following vulnerability has been resolved:

mm/page_alloc: change all pageblocks migrate type on coalescing

When a page is freed it coalesces with a buddy into a higher order page while possible. When the buddy page migrate type differs, it is expected to be updated to match the one of the page being freed.

However, only the first pageblock of the buddy page is updated, while the rest of the pageblocks are left unchanged.

That causes warnings in later expand() and other code paths (like below), since an inconsistency between migration type of the list containing the page and the page-owned pageblocks migration types is introduced.

[ 308.986589] ------------[ cut here ]------------ [ 308.987227] page type is 0, passed migratetype is 1 (nr=256) [ 308.987275] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:812 expand+0x23c/0x270 [ 308.987293] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E) [ 308.987439] Unloaded tainted modules: hmac_s390(E):2 [ 308.987650] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G E 6.18.0-gcc-bpf-debug #431 PREEMPT [ 308.987657] Tainted: [E]=UNSIGNED_MODULE [ 308.987661] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0) [ 308.987666] Krnl PSW : 0404f00180000000 00000349976fa600 (expand+0x240/0x270) [ 308.987676] R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 308.987682] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88 [ 308.987688] 0000000000000005 0000034980000005 000002be803ac000 0000023efe6c8300 [ 308.987692] 0000000000000008 0000034998d57290 000002be00000100 0000023e00000008 [ 308.987696] 0000000000000000 0000000000000000 00000349976fa5fc 000002c99b1eb6f0 [ 308.987708] Krnl Code: 00000349976fa5f0: c020008a02f2 larl %r2,000003499883abd4 00000349976fa5f6: c0e5ffe3f4b5 brasl %r14,0000034997378f60 #00000349976fa5fc: af000000 mc 0,0 >00000349976fa600: a7f4ff4c brc 15,00000349976fa498 00000349976fa604: b9040026 lgr %r2,%r6 00000349976fa608: c0300088317f larl %r3,0000034998800906 00000349976fa60e: c0e5fffdb6e1 brasl %r14,00000349976b13d0 00000349976fa614: af000000 mc 0,0 [ 308.987734] Call Trace: [ 308.987738] [<00000349976fa600>] expand+0x240/0x270 [ 308.987744] ([<00000349976fa5fc>] expand+0x23c/0x270) [ 308.987749] …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

timers: Fix NULL function pointer race in timer_shutdown_sync()

There is a race condition between timer_shutdown_sync() and timer expiration that can lead to hitting a WARN_ON in expire_timers().

The issue occurs when timer_shutdown_sync() clears the timer function to NULL while the timer is still running on another CPU. The race scenario looks like this:

CPU0 CPU1 <SOFTIRQ> lock_timer_base() expire_timers() base->running_timer = timer; unlock_timer_base() [call_timer_fn enter] mod_timer() ... timer_shutdown_sync() lock_timer_base() // For now, will not detach the timer but only clear its function to NULL if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base() [call_timer_fn exit] lock_timer_base() base->running_timer = NULL; unlock_timer_base() ... // Now timer is pending while its function set to NULL. // next timer trigger <SOFTIRQ> expire_timers() WARN_ON_ONCE(!fn) // hit ... lock_timer_base() // Now timer will detach if (base->running_timer != timer) ret = detach_if_pending(timer, base, true); if (shutdown) timer->function = NULL; unlock_timer_base()

The problem is that timer_shutdown_sync() clears the timer function regardless of whether the timer is currently running. This can leave a pending timer with a NULL function pointer, which triggers the WARN_ON_ONCE(!fn) check in expire_timers().

Fix this by only clearing the timer function when actually detaching the timer. If the timer is running, leave the function pointer intact, which is safe because the timer will be properly detached when it finishes running.(CVE-2025-68214)

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency

Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it.(CVE-2025-68817)

In the Linux kernel, the following vulnerability has been resolved:

tpm: Cap the number of PCR banks

tpm2_get_pcr_allocation() does not cap any upper limit for the number of banks. Cap the limit to eight banks so that out of bounds values coming from external I/O cause on only limited harm.(CVE-2025-71077)

In the Linux kernel, the following vulnerability has been resolved:

mm/page_alloc: change all pageblocks migrate type on coalescing

When a page is freed it coalesces with a buddy into a higher order page while possible. When the buddy page migrate type differs, it is expected to be updated to match the one of the page being freed.

However, only the first pageblock of the buddy page is updated, while the rest of the pageblocks are left unchanged.

That causes warnings in later expand() and other code paths (like below), since an inconsistency between migration type of the list containing the page and the page-owned pageblocks migration types is introduced.

[ 308.986589] ------------[ cut here ]------------ [ 308.987227] page type is 0, passed migratetype is 1 (nr=256) [ 308.987275] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:812 expand+0x23c/0x270 [ 308.987293] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E)…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)

• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

• kernel: gfs2: add some missing log locking (CVE-2026-53049)

• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)

• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

• Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)

• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

• kernel: gfs2: add some missing log locking (CVE-2026-53049)

• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)

• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

• Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-23105 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-23105 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-23105 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2026-23105 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-23105 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq. use cl_is_active instead of relying on the child qdisc's qlen to determine class activation.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)
• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
• kernel: gfs2: add some missing log locking (CVE-2026-53049)
• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)
• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)
• AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)
• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)
• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
• kernel: gfs2: add some missing log locking (CVE-2026-53049)
• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)
• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)
• AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)
• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag

This is more of a preventive patch to make the code more consistent and to prevent possible exploits that employ child qlen manipulations on qfq. use cl_is_active instead of relying on the child qdisc's qlen to determine class activation.

• fix: "vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}"
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag {CVE-2026-23105}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• via_wdt: fix critical boot hang due to unnamed resource allocation {CVE-2025-71114}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• Revert "fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}"
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• btrfs: output extra debug info if we failed to find an inline backref {CVE-2023-53672}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release(CVE-2023-53484)
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mxds|mx {CVE-2022-50521}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
• i2c: ismt: use correct length when copy buffer {CVE-2022-50394}
• misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• kvm: avoid speculation-based attacks from out-of-range memslot accesses {CVE-2021-47277}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• USB: core: Add routines for endpoint checks in old drivers
• xen: sync some headers with xen tree
• squashfs: fix memory leak in squashfs_fill_super {CVE-2025-38415}
• pptp: fix pptp_xmit() error path {CVE-2025-38574}
• Revert "net/sched: sch_hfsc: Ensure inner classes have fsc curve" {CVE-2023-4623}

• fix: "vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}"
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag {CVE-2026-23105}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• via_wdt: fix critical boot hang due to unnamed resource allocation {CVE-2025-71114}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• Revert "fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}"
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• btrfs: output extra debug info if we failed to find an inline backref {CVE-2023-53672}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release(CVE-2023-53484)
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mxds|mx {CVE-2022-50521}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
• i2c: ismt: use correct length when copy buffer {CVE-2022-50394}
• misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• kvm: avoid speculation-based attacks from out-of-range memslot accesses {CVE-2021-47277}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• USB: core: Add routines for endpoint checks in old drivers
• xen: sync some headers with xen tree
• squashfs: fix memory leak in squashfs_fill_super {CVE-2025-38415}
• pptp: fix pptp_xmit() error path {CVE-2025-38574}
• Revert "net/sched: sch_hfsc: Ensure inner classes have fsc curve" {CVE-2023-4623}

• fix: "vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}"
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag {CVE-2026-23105}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• via_wdt: fix critical boot hang due to unnamed resource allocation {CVE-2025-71114}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• Revert "fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}"
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• btrfs: output extra debug info if we failed to find an inline backref {CVE-2023-53672}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release(CVE-2023-53484)
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mxds|mx {CVE-2022-50521}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
• i2c: ismt: use correct length when copy buffer {CVE-2022-50394}
• misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• kvm: avoid speculation-based attacks from out-of-range memslot accesses {CVE-2021-47277}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• USB: core: Add routines for endpoint checks in old drivers
• xen: sync some headers with xen tree
• squashfs: fix memory leak in squashfs_fill_super {CVE-2025-38415}
• pptp: fix pptp_xmit() error path {CVE-2025-38574}
• Revert "net/sched: sch_hfsc: Ensure inner classes have fsc curve" {CVE-2023-4623}

• CVE-2025-39826
  • net: rose: convert 'use' field to refcount_t {CVE-2025-39826}
• CVE-2025-40146
  • blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
• CVE-2024-53216
  • nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
• CVE-2026-89778
  • isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• CVE-2026-23050
  • pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
• CVE-2025-68796
  • f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796}
• CVE-2025-68330
  • iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
• CVE-2025-40333
  • f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
• CVE-2025-40160
  • xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
• CVE-2023-54047
  • drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
• CVE-2025-68190
  • drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
• CVE-2025-68188
  • tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
• CVE-2026-89786
  • ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• CVE-2022-50764
  • ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
• CVE-2026-80785
  • fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
• CVE-2026-80788
  • nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788}
• CVE-2026-80747
  • drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}
• CVE-2026-80907
  • drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
• CVE-2026-80908
  • drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
• CVE-2026-80812
  • ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
• CVE-2026-80948
  • wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
• CVE-2025-40137
  • f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
• CVE-2023-54150
  • drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
• CVE-2026-89784
  • SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
• CVE-2026-89783
  • xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
• CVE-2026-89780
  • net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780}
• CVE-2026-89777
  • vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777}
• CVE-2026-89789
  • gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
• CVE-2025-68797
  • char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
• CVE-2025-68767
  • hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
• CVE-2026-63961
  • usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961}
• CVE-2026-63904
  • usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
• CVE-2022-50864
  • nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
• CVE-2025-68771
  • ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
• CVE-2025-68750
  • usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
• CVE-2026-80909
  • drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909}
• CVE-2026-74402
  • crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} *…

In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: .

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs are sent from the pkt queue.

In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01).

In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev().

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by one compactly.

In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __smb2_lease_break_noti() Move tcp_transport free to ksmbd_conn_free.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL.

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.)(CVE-2025-37823).

In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence .

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes.

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xe_migrate_clear The intent of the error path in xe_migrate_clear is to wait on locally generated fence and then return.

In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report .

In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report .

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted…

Upstream kernel version 6.6.130 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.6.130 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
• CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
• CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
• CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
• CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
• CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
• CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
• CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
• CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
• CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
• CVE-2026-23084:…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
• CVE-2026-23084: be2net: Fix NULL pointer…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-50453: gpiolib: cdev: fix NULL-pointer dereferences (bsc#1250887).
• CVE-2023-53794: cifs: fix session state check in reconnect to avoid use-after-free issue (bsc#1255163).
• CVE-2023-53802: wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function (bsc#1254725).
• CVE-2023-53808: wifi: mwifiex: fix memory leak in mwifiex_histogram_read() (bsc#1254723).
• CVE-2023-53816: drm/amdkfd: fix potential kgd_mem UAFs (bsc#1254958).
• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2023-53827: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (bsc#1255049).
• CVE-2023-54184: scsi: target: iscsit: Free cmds before session free (bsc#1255991).
• CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (bsc#1238917).
• CVE-2025-22083: vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint (bsc#1241414).
• CVE-2025-22125: md/raid1,raid10: do not ignore IO flags (bsc#1241596).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40219: PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV (bsc#1254518).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40342: nvme-fc: use lock accessing port_state and rport state (bsc#1255274).
• CVE-2025-68223: drm/radeon: delete radeon_fence_process in is_signaled, no deadlock (bsc#1255357).
• CVE-2025-68234: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
• CVE-2025-68287: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (bsc#1255152).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68724: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (bsc#1255550).
• CVE-2025-68818: scsi: qla2xxx: Perform lockless command completion in abort path (bsc#1256675).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
• CVE-2025-71131: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (bsc#1256742).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71224: wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (bsc#1258824).
• CVE-2025-71236: scsi: qla2xxx: Validate sp before freeing associated memory (bsc#1258442).
• CVE-2026-22991: libceph: make free_choose_arg_map() resilient to partial allocation (bsc#1257220).
• CVE-2026-22998: nvme-tcp: fix NULL…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (bsc#1253455).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68735: drm/panthor: Prevent potential UAF in group creation (bsc#1255811).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71066: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (bsc#1256645).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
• CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
• CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
• CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
• CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
• CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
• CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
• CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).
• CVE-2026-23104: ice: fix devlink reload call trace…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-68283: libceph: replace BUG_ON with bounds check for map->max_osd (bsc#1255379).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68374: md: fix rcu protection in md_wakeup_thread (bsc#1255530).
• CVE-2025-68736: landlock: Fix handling of disconnected directories (bsc#1255698).
• CVE-2025-68778: btrfs: don't log conflicting inode if it's a dir moved in the current transaction (bsc#1256683).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71113: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (bsc#1256716).
• CVE-2025-71126: mptcp: reset fallback status gracefully at disconnect() time (bsc#1256755).
• CVE-2025-71148: net/handshake: restore destructor on submit failure (bsc#1257159).
• CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction (bsc#1257635).
• CVE-2025-71194: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (bsc#1257687).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22982: net: mscc: ocelot: Fix crash when adding interface under a lag (bsc#1257179).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: geneve: Fix incorrect inner network header offset when innerprotoinherit is set (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23060: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (bsc#1257735).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: fou: Don't allow 0 for FOU_ATTR_IPPROTO (bsc#1257745).
• CVE-2026-23084: be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (bsc#1257830).
• CVE-2026-23085: irqchip/gic-v3-its: Avoid truncating memory addresses (bsc#1257758).
• CVE-2026-23086: vsock/virtio: cap TX credit to local buffer size (bsc#1257757).
• CVE-2026-23089: ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (bsc#1257790).
• CVE-2026-23095: gue: Fix skb memleak with inner IP protocol 0 (bsc#1257808).
• CVE-2026-23099: bonding: limit BOND_MODE_8023AD to Ethernet devices (bsc#1257816).
• CVE-2026-23102: arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state (bsc#1257772).
• CVE-2026-23104: ice: fix devlink reload call trace…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
• CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
• CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
• CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
• CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
• CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
• CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
• CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
• CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
• CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
• CVE-2026-23084:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
• CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
• CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
• CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
• CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
• CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
• CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
• CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
• CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
• CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
• CVE-2026-23084:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
• CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
• CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
• CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
• CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
• CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
• CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
• CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
• CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
• CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
• CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
• CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
• CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
• CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
• CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
• CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
• CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
• CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
• CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
• CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
• CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
• CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
• CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
• CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
• CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
• CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
• CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
• CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
• CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
• CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
• CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
• CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
• CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
• CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
• CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
• CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
• CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
• CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
• CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
• CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
• CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
• CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
• CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
• CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
• CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
• CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
• CVE-2026-23084:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-39753: gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops (bsc#1249590).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
• CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
• CVE-2025-40230: mm: prevent poison consumption when splitting THP (bsc#1254817).
• CVE-2025-68173: ftrace: Fix softlockup in ftrace_module_enable (bsc#1255311).
• CVE-2025-68186: ring-buffer: Do not warn in ring_buffer_map_get_reader() when reader catches up (bsc#1255144).
• CVE-2025-68292: mm/memfd: fix information leak in hugetlb folios (bsc#1255148).
• CVE-2025-68295: smb: client: fix memory leak in cifs_construct_tcon() (bsc#1255129).
• CVE-2025-68329: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs (bsc#1255490).
• CVE-2025-68371: scsi: smartpqi: Fix device resources accessed after device removal (bsc#1255572).
• CVE-2025-68745: scsi: qla2xxx: Clear cmds after chip reset (bsc#1255721).
• CVE-2025-68785: net: openvswitch: fix middle attribute validation in push_nsh() action (bsc#1256640).
• CVE-2025-68810: KVM: Disallow toggling KVM_MEM_GUEST_MEMFD on an existing memslot (bsc#1256679).
• CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral (bsc#1256802).
• CVE-2025-71104: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer (bsc#1256708).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71134: mm/page_alloc: change all pageblocks migrate type on coalescing (bsc#1256732).
• CVE-2025-71161: dm-verity: disable recursive forward error correction (bsc#1257174).
• CVE-2025-71184: btrfs: tracepoints: use btrfs_root_id() to get the id of a root (bsc#1257635).
• CVE-2025-71193: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend (bsc#1257686).
• CVE-2025-71225: md: suspend array while updating raid_disks via sysfs (bsc#1258411).
• CVE-2026-22979: net: fix memory leak in skb_segment_list for GRO packets (bsc#1257228).
• CVE-2026-22998: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (bsc#1257209).
• CVE-2026-23003: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (bsc#1257246).
• CVE-2026-23004: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (bsc#1257231).
• CVE-2026-23010: ipv6: Fix use-after-free in inet6_addr_del() (bsc#1257332).
• CVE-2026-23017: idpf: fix error handling in the init_task on load (bsc#1257552).
• CVE-2026-23022: idpf: fix memory leak in idpf_vc_core_deinit() (bsc#1257581).
• CVE-2026-23023: idpf: fix memory leak in idpf_vport_rel() (bsc#1257556).
• CVE-2026-23024: idpf: fix memory leak of flow steer list on rmmod (bsc#1257572).
• CVE-2026-23035: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (bsc#1257559).
• CVE-2026-23042: idpf: fix aux device unplugging when rdma is not supported by vport (bsc#1257705).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23053: NFS: Fix a deadlock involving nfs_release_folio() (bsc#1257718).
• CVE-2026-23057: vsock/virtio: Coalesce only linear skb (bsc#1257740).
• CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref (bsc#1257765).
• CVE-2026-23066: rxrpc: Fix recvmsg() unconditional requeue (bsc#1257726).
• CVE-2026-23068: spi: spi-sprd-adi: Fix double free in probe error path (bsc#1257805).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23070: Octeontx2-af: Add proper checks for fwdata (bsc#1257709).
• CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc (bsc#1257749).
• CVE-2026-23083: tools: ynl-gen: use big-endian netlink attribute types (bsc#1257745).
• CVE-2026-23084:…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• Cryptographic API;
• Drivers core;
• Bluetooth drivers;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• UACCE accelerator framework;
• Ethernet bonding driver;
• Network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• NVME drivers;
• PHY drivers;
• SLIMbus drivers;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• NFC subsystem;
• BPF subsystem;
• IRQ subsystem;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• Netfilter;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• XFRM subsystem;
• Creative Sound Blaster X-Fi driver;
• USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-37849, CVE-2025-38057, CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164, CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71080, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026, CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23060, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23074, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23111, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• Drivers core;
• Bluetooth drivers;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• UACCE accelerator framework;
• Ethernet bonding driver;
• Network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• NVME drivers;
• PHY drivers;
• SLIMbus drivers;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• NFC subsystem;
• BPF subsystem;
• IRQ subsystem;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• XFRM subsystem;
• Creative Sound Blaster X-Fi driver;
• USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-38057, CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164, CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026, CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• Drivers core;
• Bluetooth drivers;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• UACCE accelerator framework;
• Ethernet bonding driver;
• Network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• NVME drivers;
• PHY drivers;
• SLIMbus drivers;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• NFC subsystem;
• BPF subsystem;
• IRQ subsystem;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• XFRM subsystem;
• Creative Sound Blaster X-Fi driver;
• USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-38057, CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164, CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026, CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• Drivers core;
• Bluetooth drivers;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• UACCE accelerator framework;
• Ethernet bonding driver;
• Network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• NVME drivers;
• PHY drivers;
• SLIMbus drivers;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• NFC subsystem;
• BPF subsystem;
• IRQ subsystem;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• XFRM subsystem;
• Creative Sound Blaster X-Fi driver;
• USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-38057, CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164, CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026, CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• Drivers core;
• Bluetooth drivers;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• UACCE accelerator framework;
• Ethernet bonding driver;
• Network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• NVME drivers;
• PHY drivers;
• SLIMbus drivers;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• NFC subsystem;
• BPF subsystem;
• IRQ subsystem;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• XFRM subsystem;
• Creative Sound Blaster X-Fi driver;
• USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-38057, CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164, CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026, CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• Drivers core;
• Bluetooth drivers;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• UACCE accelerator framework;
• Ethernet bonding driver;
• Network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• NVME drivers;
• PHY drivers;
• SLIMbus drivers;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• NFC subsystem;
• BPF subsystem;
• IRQ subsystem;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• XFRM subsystem;
• Creative Sound Blaster X-Fi driver;
• USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-38057, CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164, CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026, CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• Drivers core;
• Bluetooth drivers;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• UACCE accelerator framework;
• Ethernet bonding driver;
• Network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• NVME drivers;
• PHY drivers;
• SLIMbus drivers;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• NFC subsystem;
• BPF subsystem;
• IRQ subsystem;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• XFRM subsystem;
• Creative Sound Blaster X-Fi driver;
• USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-38057, CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164, CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026, CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• Block layer subsystem;
• Drivers core;
• Bluetooth drivers;
• DMA engine subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• UACCE accelerator framework;
• Ethernet bonding driver;
• Network drivers;
• STMicroelectronics network drivers;
• Ethernet team driver;
• NVME drivers;
• PHY drivers;
• SLIMbus drivers;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• Ext4 file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• NFC subsystem;
• BPF subsystem;
• IRQ subsystem;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• XFRM subsystem;
• Creative Sound Blaster X-Fi driver;
• USB sound devices; (CVE-2023-53421, CVE-2023-53520, CVE-2023-53662, CVE-2023-54207, CVE-2025-38057, CVE-2025-38125, CVE-2025-38232, CVE-2025-38408, CVE-2025-38591, CVE-2025-40149, CVE-2025-40164, CVE-2025-68211, CVE-2025-68340, CVE-2025-68365, CVE-2025-68725, CVE-2025-68817, CVE-2025-71080, CVE-2025-71162, CVE-2025-71163, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71190, CVE-2025-71191, CVE-2025-71194, CVE-2025-71196, CVE-2025-71197, CVE-2025-71199, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23001, CVE-2026-23003, CVE-2026-23011, CVE-2026-23026, CVE-2026-23033, CVE-2026-23037, CVE-2026-23038, CVE-2026-23049, CVE-2026-23056, CVE-2026-23058, CVE-2026-23061, CVE-2026-23063, CVE-2026-23064, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23087, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23103, CVE-2026-23105, CVE-2026-23108, CVE-2026-23119, CVE-2026-23120, CVE-2026-23121, CVE-2026-23124, CVE-2026-23125, CVE-2026-23128, CVE-2026-23133, CVE-2026-23145, CVE-2026-23146, CVE-2026-23150, CVE-2026-23164, CVE-2026-23167, CVE-2026-23170, CVE-2026-23209)