CVE-2026-23260

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MMWe currently assume that there is at least one VMA in a MM, which isn ttrue.So we might end up having find_vma() return NULL, to then de-referenceNULL. So properly handle find_vma() returning NULL.This fixes the report:Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024RIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]RIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194Code: ...RSP: 0018:ffffc9000375fd08 EFLAGS: 00010246RAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000RDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044RBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1R10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003R13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8FS: 00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: <TASK> kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709 __do_sys_migrate_pages mm/mempolicy.c:1727 [inline] __se_sys_migrate_pages mm/mempolicy.c:1723 [inline] __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/[email protected]: add unlikely()

In the Linux kernel, the following vulnerability has been resolved:

PCI/MSI: Handle lack of irqdomain gracefully

Alexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a RISCV platform which does not provide PCI/MSI support:

WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32 __pci_enable_msix_range+0x30c/0x596 pci_msi_setup_msi_irqs+0x2c/0x32 pci_alloc_irq_vectors_affinity+0xb8/0xe2

RISCV uses hierarchical interrupt domains and correctly does not implement the legacy fallback. The warning triggers from the legacy fallback stub.

That warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent domain is associated with the device or not. There is a check for MSI-X, which has a legacy assumption. But that legacy fallback assumption is only valid when legacy support is enabled, but otherwise the check should simply return -ENOTSUPP.

Loongarch tripped over the same problem and blindly enabled legacy support without implementing the legacy fallbacks. There are weak implementations which return an error, so the problem was papered over.

Correct pci_msi_domain_supports() to evaluate the legacy mode and add the missing supported check into the MSI enable path to complete it.(CVE-2024-56760)

In the Linux kernel, the following vulnerability has been resolved:

NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback

Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.

Otherwise NFS can deadlock waiting for kcompactd enduced writeback which recurses back to NFS (which triggers writeback to NFSD via NFS loopback mount on the same host, NFSD blocks waiting for XFS's call to __filemap_get_folio):

6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.

{--- [58] "kcompactd0" [<0>]…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MMWe currently assume that there is at least one VMA in a MM, which isn ttrue.So we might end up having find_vma() return NULL, to then de-referenceNULL. So properly handle find_vma() returning NULL.This fixes the report:Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]CPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024RIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline]RIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194Code: ...RSP: 0018:ffffc9000375fd08 EFLAGS: 00010246RAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000RDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044RBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1R10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003R13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8FS: 00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: <TASK> kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709 __do_sys_migrate_pages mm/mempolicy.c:1727 [inline] __se_sys_migrate_pages mm/mempolicy.c:1723 [inline] __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/[email protected]: add unlikely()

In the Linux kernel, the following vulnerability has been resolved:

PCI/MSI: Handle lack of irqdomain gracefully

Alexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a RISCV platform which does not provide PCI/MSI support:

WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32 __pci_enable_msix_range+0x30c/0x596 pci_msi_setup_msi_irqs+0x2c/0x32 pci_alloc_irq_vectors_affinity+0xb8/0xe2

RISCV uses hierarchical interrupt domains and correctly does not implement the legacy fallback. The warning triggers from the legacy fallback stub.

That warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent domain is associated with the device or not. There is a check for MSI-X, which has a legacy assumption. But that legacy fallback assumption is only valid when legacy support is enabled, but otherwise the check should simply return -ENOTSUPP.

Loongarch tripped over the same problem and blindly enabled legacy support without implementing the legacy fallbacks. There are weak implementations which return an error, so the problem was papered over.

Correct pci_msi_domain_supports() to evaluate the legacy mode and add the missing supported check into the MSI enable path to complete it.(CVE-2024-56760)

In the Linux kernel, the following vulnerability has been resolved:

NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback

Add PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so nfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.

Otherwise NFS can deadlock waiting for kcompactd enduced writeback which recurses back to NFS (which triggers writeback to NFSD via NFS loopback mount on the same host, NFSD blocks waiting for XFS's call to __filemap_get_folio):

6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.

{--- [58] "kcompactd0" [<0>]…

Root has patched CVE-2026-23260 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-23260 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-23260 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-23260 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: regmap: maple: free entry on mas_store_gfp() failure regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gfp() fails, the new 'entry' remains allocated and is never freed, leaking memory. Free 'entry' on the failure path; on success continue freeing the replaced neighbor blocks ('lower', 'upper').

• KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level {CVE-2026-63807}
• KVM: x86: Check for invalid/obsolete root after making MMU pages available {CVE-2026-64561}
• ubi: Fix use-after-free when volume resizing failed {CVE-2023-53271}
• ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() {CVE-2025-37912}
• wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() {CVE-2026-53318}
• dpll: Prevent duplicate registrations {CVE-2026-23129}
• pinmux: fix race causing mux_owner NULL with active mux_usecount {CVE-2025-38632}
• HID: apple: validate feature-report field count to prevent NULL pointer dereference {CVE-2025-38557}
• thunderbolt: Limit XDomain response copy to actual frame size {CVE-2026-53146}
• net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery {CVE-2026-43466}
• virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false {CVE-2026-31469}
• scsi: target: Reset t_task_cdb pointer in error case {CVE-2025-68782}
• ubi: ubi_create_volume: Fix use-after-free when volume creation failed {CVE-2022-49388}
• drm/xe/reg_sr: Fix leak on xa_store failure {CVE-2026-23418}
• ASoC: soc-core: flush delayed work before removing DAIs and widgets {CVE-2026-43459}
• md/raid10: wait barrier before returning discard request with REQ_NOWAIT {CVE-2025-40325}
• nbd: defer config put in recv_work {CVE-2025-68372}
• nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference {CVE-2026-23148}
• net: hns3: using the num_tqps in the vf driver to apply for resources {CVE-2025-71064}
• net/mlx5e: Disable MACsec offload for uplink representor profile {CVE-2025-38020}
• serial: imx: fix tx statemachine deadlock {CVE-2023-52456}
• dm-thin: fix metadata refcount underflow {CVE-2026-46107}
• net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure {CVE-2026-53229}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• usbnet:fix NPE during rx_complete {CVE-2025-22050}
• platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it {CVE-2025-21645}
• driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() {CVE-2025-21810}
• usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
• ALSA: seq: dummy: fix UMP event stack overread {CVE-2026-53241}
• pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled {CVE-2026-31655}
• net/mlx5: Bridge, fix the crash caused by LAG state check {CVE-2025-21970}
• ALSA: timer: Don't take register_mutex with copy_from/to_user() {CVE-2025-23134}
• md/raid5: validate payload size before accessing journal metadata {CVE-2026-46070}
• nvmet-fc: move lsop put work to nvmet_fc_ls_req_op {CVE-2025-40171}
• iommu: Fix potential memory leak in iopf_queue_remove_device() {CVE-2025-21770}
• Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak {CVE-2025-40035}
• scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails {CVE-2026-45997}
• can: dev: can_set_termination(): allow sleeping GPIOs {CVE-2024-56625}
• nvme-tcp: fix the memleak while create new ctrl failed {CVE-2024-56632}
• ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() {CVE-2026-46146}
• pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains {CVE-2026-23187}
• wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path {CVE-2025-22128}
• octeon_ep: Fix memory leak in octep_device_setup() {CVE-2026-23160}
• pinctrl: check the return value of pinmux_ops::get_function_name() {CVE-2025-40030}
• net: tun: fix tun_napi_alloc_frags() {CVE-2024-56372}
• wifi: iwlwifi: mvm: clean up ROC on failure {CVE-2025-21906}
• ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275}
• dpll: fix xa_alloc_cyclic() error handling {CVE-2025-22016}
• usb: usbtmc: Flush anchored URBs in usbtmc_release {CVE-2026-31758}
• RDMA/siw: Fix potential NULL pointer dereference in header processing…

In the Linux kernel, the following vulnerability has been resolved:

regmap: maple: free entry on mas_store_gfp() failure

regcache_maple_write() allocates a new block ('entry') to merge adjacent ranges and then stores it with mas_store_gfp(). When mas_store_gfp() fails, the new 'entry' remains allocated and is never freed, leaking memory.

Free 'entry' on the failure path; on success continue freeing the replaced neighbor blocks ('lower', 'upper').

Upstream kernel version 6.6.130 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.6.130 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
• CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
• CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323:…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Cryptographic API;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Cryptographic API;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Cryptographic API;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Cryptographic API;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Packet sockets;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105, CVE-2026-23107,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Compute Acceleration Framework;
• Drivers core;
• Null block device driver;
• Ublk userspace block driver;
• Bluetooth drivers;
• Counter interface drivers;
• DMA engine subsystem;
• DPLL subsystem;
• GPU drivers;
• HID subsystem;
• Intel Trace Hub HW tracing drivers;
• IIO ADC drivers;
• IIO subsystem;
• On-Chip Interconnect management framework;
• IRQ chip drivers;
• Modular ISDN driver;
• LED subsystem;
• Multiple devices driver;
• UACCE accelerator framework;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• NVME drivers;
• PHY drivers;
• x86 platform drivers;
• i.MX PM domains;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• TCM subsystem;
• W1 Dallas's 1-wire bus driver;
• Xen hypervisor drivers;
• BTRFS file system;
• EFI Variable file system;
• exFAT file system;
• Ext4 file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• SMB network file system;
• Scheduler infrastructure;
• Netfilter;
• NFC subsystem;
• Tracing infrastructure;
• io_uring subsystem;
• BPF subsystem;
• Perf events;
• Floating proportions library;
• Memory management;
• Bluetooth subsystem;
• CAN network layer;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• NET/ROM layer;
• Network traffic control;
• SCTP protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• Wireless networking;
• ALSA AC97 driver;
• Generic PCM loopback sound driver;
• Creative Sound Blaster X-Fi driver;
• AMD SoC Alsa drivers;
• Texas InstrumentS Audio (ASoC/HDA) drivers;
• USB sound devices;
• KVM subsystem; (CVE-2024-50004, CVE-2024-58096, CVE-2024-58097, CVE-2025-37926, CVE-2025-38201, CVE-2025-38591, CVE-2025-40039, CVE-2025-40082, CVE-2025-40149, CVE-2025-68351, CVE-2025-68358, CVE-2025-68365, CVE-2025-68725, CVE-2025-68749, CVE-2025-68803, CVE-2025-68823, CVE-2025-71160, CVE-2025-71162, CVE-2025-71163, CVE-2025-71180, CVE-2025-71182, CVE-2025-71183, CVE-2025-71184, CVE-2025-71185, CVE-2025-71186, CVE-2025-71188, CVE-2025-71189, CVE-2025-71190, CVE-2025-71191, CVE-2025-71192, CVE-2025-71193, CVE-2025-71194, CVE-2025-71195, CVE-2025-71196, CVE-2025-71197, CVE-2025-71198, CVE-2025-71199, CVE-2025-71200, CVE-2025-71220, CVE-2025-71222, CVE-2025-71224, CVE-2025-71225, CVE-2025-71268, CVE-2026-22976, CVE-2026-22977, CVE-2026-22978, CVE-2026-22979, CVE-2026-22980, CVE-2026-22982, CVE-2026-22984, CVE-2026-22990, CVE-2026-22991, CVE-2026-22992, CVE-2026-22994, CVE-2026-22996, CVE-2026-22997, CVE-2026-22998, CVE-2026-22999, CVE-2026-23000, CVE-2026-23001, CVE-2026-23003, CVE-2026-23005, CVE-2026-23006, CVE-2026-23010, CVE-2026-23011, CVE-2026-23019, CVE-2026-23020, CVE-2026-23021, CVE-2026-23025, CVE-2026-23026, CVE-2026-23030, CVE-2026-23031, CVE-2026-23032, CVE-2026-23033, CVE-2026-23035, CVE-2026-23037, CVE-2026-23038, CVE-2026-23047, CVE-2026-23049, CVE-2026-23050, CVE-2026-23053, CVE-2026-23054, CVE-2026-23056, CVE-2026-23057, CVE-2026-23058, CVE-2026-23059, CVE-2026-23061, CVE-2026-23062, CVE-2026-23063, CVE-2026-23064, CVE-2026-23065, CVE-2026-23068, CVE-2026-23069, CVE-2026-23071, CVE-2026-23073, CVE-2026-23075, CVE-2026-23076, CVE-2026-23078, CVE-2026-23080, CVE-2026-23083, CVE-2026-23084, CVE-2026-23085, CVE-2026-23086, CVE-2026-23087, CVE-2026-23088, CVE-2026-23089, CVE-2026-23090, CVE-2026-23091, CVE-2026-23093, CVE-2026-23094, CVE-2026-23095, CVE-2026-23096, CVE-2026-23097, CVE-2026-23098, CVE-2026-23099, CVE-2026-23101, CVE-2026-23102, CVE-2026-23103, CVE-2026-23105, CVE-2026-23107,…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local attacker could use this to cause memory corruption and, theoretically, arbitrary code execution. (CVE-2026-47331)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of fine- grained network socket mediation. (CVE-2026-47336)

Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local attacker could use this to cause a…

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local attacker could use this to cause memory corruption and, theoretically, arbitrary code execution. (CVE-2026-47331)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling AppArmor AF_INET/AF_INET6 socket…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local attacker could use this to cause memory corruption and, theoretically, arbitrary code execution. (CVE-2026-47331)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of fine- grained network socket mediation. (CVE-2026-47336)

Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local attacker could use this to cause a…