CVE-2026-23393

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from br_cfm_frame_rx() are silently rejected. The cc_peer_disable() helper retains cancel_delayed_work_sync() because it is also used for the CC enable/disable toggle path where the work must remain re-schedulable.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to detect potential corrupted nid in free_nid_list

As reported, on-disk footer.ino and footer.nid is the same and out-of-range, let's add sanity check on f2fs_alloc_nid() to detect any potential corruption in free_nid_list.(CVE-2025-68315)

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: Fix uninit buffer allocated by __getname()

Fix uninit errors caused after buffer allocation given to 'de'; by initializing the buffer with zeroes. The fix was found by using KMSAN.(CVE-2025-68727)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no RCU grace period in between.

This creates two use-after-free conditions:

1. Control-plane: nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be walking the chain when the error path frees it.

2. Packet path: for NFPROTO_INET, nf_register_net_hook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain.

Add synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.(CVE-2026-23231)

In the Linux kernel, the following vulnerability has been resolved:

tls: Fix race condition in tls_sw_cancel_work_tx()

This issue was discovered during a code audit.

After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object.

The following is a simple race scenario:

      cpu0                         cpu1

tls_sk_proto_close() tls_sw_cancel_work_tx() tls_write_space() tls_sw_write_space() if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask)) set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask); cancel_delayed_work_sync(&ctx->tx_work.work); schedule_delayed_work(&tx_ctx->tx_work.work, 0);

To prevent this race condition, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync().(CVE-2026-23240)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_gate: snapshot parameters with RCU on replace

The gate action can be replaced while the hrtimer callback or dump path is walking the schedule list.

Convert the parameters to an RCU-protected snapshot and swap updates under tcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits the entry list, preserve the existing schedule so the effective state is unchanged.(CVE-2026-23245)

In the Linux kernel, the following vulnerability has been resolved:

net: gro: fix outer network offset

The udp GRO complete stage assumes that all the packets inserted the RX have the encapsulation flag zeroed. Such assumption is not true, as a few H/W NICs can set such flag when H/W offloading the checksum for an UDP encapsulated traffic, the tun driver can inject GSO packets with UDP encapsulation and the problematic layout can also be created via a veth based setup.

Due to the above, in the problematic scenarios, udp4_gro_complete() uses the wrong network offset (inner…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to detect potential corrupted nid in free_nid_list

As reported, on-disk footer.ino and footer.nid is the same and out-of-range, let's add sanity check on f2fs_alloc_nid() to detect any potential corruption in free_nid_list.(CVE-2025-68315)

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: Fix uninit buffer allocated by __getname()

Fix uninit errors caused after buffer allocation given to 'de'; by initializing the buffer with zeroes. The fix was found by using KMSAN.(CVE-2025-68727)

In the Linux kernel, a security vulnerability exists in the IOMMU Shared Virtual Addressing (SVA) feature. On x86 architecture when CONFIG_X86 is set, IOMMU hardware caches kernel page table entries. Due to the lack of notification mechanism for kernel page table changes, when kernel page table pages are freed and reused, the IOMMU may retain stale entries, leading to Use-After-Free (UAF) and Write-After-Free (WAF) conditions. This can be exploited to cause arbitrary physical memory DMA access or privilege escalation.(CVE-2025-71089)

In the Linux kernel, the following vulnerability has been resolved:

uacce: fix cdev handling in the cleanup path

When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove.(CVE-2026-23096)

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix use-after-free due to enslave fail after slave array update

Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems.

It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy

Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn"

The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to detect potential corrupted nid in free_nid_list

As reported, on-disk footer.ino and footer.nid is the same and out-of-range, let's add sanity check on f2fs_alloc_nid() to detect any potential corruption in free_nid_list.(CVE-2025-68315)

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: Fix uninit buffer allocated by __getname()

Fix uninit errors caused after buffer allocation given to 'de'; by initializing the buffer with zeroes. The fix was found by using KMSAN.(CVE-2025-68727)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

nf_tables_addchain() publishes the chain to table->chains via list_add_tail_rcu() (in nft_chain_add()) before registering hooks. If nf_tables_register_hook() then fails, the error path calls nft_chain_del() (list_del_rcu()) followed by nf_tables_chain_destroy() with no RCU grace period in between.

This creates two use-after-free conditions:

1. Control-plane: nf_tables_dump_chains() traverses table->chains under rcu_read_lock(). A concurrent dump can still be walking the chain when the error path frees it.

2. Packet path: for NFPROTO_INET, nf_register_net_hook() briefly installs the IPv4 hook before IPv6 registration fails. Packets entering nft_do_chain() via the transient IPv4 hook can still be dereferencing chain->blob_gen_X when the error path frees the chain.

Add synchronize_rcu() between nft_chain_del() and the chain destroy so that all RCU readers -- both dump threads and in-flight packet evaluation -- have finished before the chain is freed.(CVE-2026-23231)

In the Linux kernel, the following vulnerability has been resolved:

tls: Fix race condition in tls_sw_cancel_work_tx()

This issue was discovered during a code audit.

After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object.

The following is a simple race scenario:

      cpu0                         cpu1

tls_sk_proto_close() tls_sw_cancel_work_tx() tls_write_space() tls_sw_write_space() if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask)) set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask); cancel_delayed_work_sync(&ctx->tx_work.work); schedule_delayed_work(&tx_ctx->tx_work.work, 0);

To prevent this race condition, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync().(CVE-2026-23240)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_gate: snapshot parameters with RCU on replace

The gate action can be replaced while the hrtimer callback or dump path is walking the schedule list.

Convert the parameters to an RCU-protected snapshot and swap updates under tcf_lock, freeing the previous snapshot via call_rcu(). When REPLACE omits the entry list, preserve the existing schedule so the effective state is unchanged.(CVE-2026-23245)

In the Linux kernel, the following vulnerability has been resolved:

net: gro: fix outer network offset

The udp GRO complete stage assumes that all the packets inserted the RX have the encapsulation flag zeroed. Such assumption is not true, as a few H/W NICs can set such flag when H/W offloading the checksum for an UDP encapsulated traffic, the tun driver can inject GSO packets with UDP encapsulation and the problematic layout can also be created via a veth based setup.

Due to the above, in the problematic scenarios, udp4_gro_complete() uses the wrong network offset (inner…

In the Linux kernel, the following vulnerability has been resolved: bridge: cfm: Fix race condition in peer_mep deletion When a peer MEP is being deleted, cancel_delayed_work_sync() is called on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in softirq context under rcu_read_lock (without RTNL) and can re-schedule ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync() returning and kfree_rcu() being called. The following is a simple race scenario: cpu0 cpu1 mep_delete_implementation() cancel_delayed_work_sync(ccm_rx_dwork); br_cfm_frame_rx() // peer_mep still in hlist if (peer_mep->ccm_defect) ccm_rx_timer_start() queue_delayed_work(ccm_rx_dwork) hlist_del_rcu(&peer_mep->head); kfree_rcu(peer_mep, rcu); ccm_rx_work_expired() // on freed peer_mep To prevent this, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync() in both peer MEP deletion paths, so that subsequent queue_delayed_work() calls from br_cfm_frame_rx() are silently rejected. The cc_peer_disable() helper retains cancel_delayed_work_sync() because it is also used for the CC enable/disable toggle path where the work must remain re-schedulable.

• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• net: add xmit recursion limit to tunnel xmit functions {CVE-2026-23276}
• x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 {CVE-2026-23005}
• wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
• net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY {CVE-2025-37945}
• xfs: delete attr leaf freemap entries when empty {CVE-2026-43158}
• ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183}
• crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
• scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list {CVE-2023-53627}
• bonding: annotate data-races around slave->last_rx {CVE-2026-23212}
• rxrpc: Fix data-race warning and potential load/store tearing {CVE-2026-23118}
• net: phy: register phy led_triggers during probe to avoid AB-BA deadlock {CVE-2026-23368}
• tracing: Do not register unsupported perf events {CVE-2025-71125}
• ACPICA: Avoid walking the Namespace if start_node is NULL {CVE-2025-71118}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• nfc: rawsock: cancel tx_work before socket teardown {CVE-2026-23372}
• bridge: cfm: Fix race condition in peer_mep deletion {CVE-2026-23393}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622}
• bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue {CVE-2024-36938}
• virtiofs: use pages instead of pointer for kernel direct IO {CVE-2024-53219}
• acct: perform last write from workqueue {CVE-2025-21846}
• NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
• atm: clip: Fix memory leak of struct clip_vcc. {CVE-2025-38546}
• efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
• CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets…

Root has patched CVE-2026-23393 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-23393 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2026-23393 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-23393 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2021-47103: inet: fully convert sk->sk_rx_dst to RCU rules (bsc#1221010).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
• CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
• CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651).
• CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).
• CVE-2026-43334: Bluetooth: SMP: force responder MITM…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
• CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
• CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
• CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
• CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31528: perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31622: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (bsc#1263797).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-46331: kernel: net/sched: fix pedit partial COW leading to page cache
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43038: ipv6: icmp: clear skb2->cb…

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2021-47103: inet: fully convert sk->sk_rx_dst to RCU rules (bsc#1221010).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
• CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
• CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651).
• CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).
• CVE-2026-43334: Bluetooth: SMP: force responder MITM requirements before building the pairing response (bsc#1265090).
• CVE-2026-43365: xfs: fix undersized l_iclog_roundoff…

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-49979: net: fix refcount bug in sk_psock_get (bsc#1245109).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
• CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
• CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-49979: net: fix refcount bug in sk_psock_get (bsc#1245109).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
• CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
• CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
• CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
• CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323:…

This update for the SUSE Linux Enterprise Kernel 6.4.0-32.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-34.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-35.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-36.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-39.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-44.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-30.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-31.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-38.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-40.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-41.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-42.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-43.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-45.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-37.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-39.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-40.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-41.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-42.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-43.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-45.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).

This update for the SUSE Linux Enterprise Kernel 6.4.0-38.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256615).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260524).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263094).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262759).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263118).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263177).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263670).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264094).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1264253).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1264252).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (bsc#1265197).
• CVE-2026-43120: RDMA/irdma: Fix double free related to rereg_user_mr (bsc#1264567).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264849).
• CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle (bsc#1265117).
• CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (bsc#1265127).
• CVE-2026-43494: RDS zerocopy attack aka PinTheft (bsc#1265945).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266015).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267206).
• CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink() (bsc#1267893).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267723).
• CVE-2026-46227: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (bsc#1267698).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266265).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268662).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269023).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269495).