CVE-2026-23449

In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teql_master_xmit Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racing with the datapath. Failure to do so may cause crashes like the following: [ 238.028993][ T318] BUG: KASAN: double-free in skb_release_data (net/core/skbuff.c:1139) [ 238.029328][ T318] Free of addr ffff88810c67ec00 by task poc_teql_uaf_ke/318 [ 238.029749][ T318] [ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: poc_teql_ke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full) [ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 238.029910][ T318] Call Trace: [ 238.029913][ T318] <TASK> [ 238.029916][ T318] dump_stack_lvl (lib/dump_stack.c:122) [ 238.029928][ T318] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 238.029940][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029944][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.029957][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029969][ T318] kasan_report_invalid_free (mm/kasan/report.c:221 mm/kasan/report.c:563) [ 238.029979][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029989][ T318] check_slab_allocation (mm/kasan/common.c:231) [ 238.029995][ T318] kmem_cache_free (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1)) [ 238.030004][ T318] skb_release_data (net/core/skbuff.c:1139) ... [ 238.030025][ T318] sk_skb_reason_drop (net/core/skbuff.c:1256) [ 238.030032][ T318] pfifo_fast_reset (./include/linux/ptr_ring.h:171 ./include/linux/ptr_ring.h:309 ./include/linux/skb_array.h:98 net/sched/sch_generic.c:827) [ 238.030039][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.030054][ T318] qdisc_reset (net/sched/sch_generic.c:1034) [ 238.030062][ T318] teql_destroy (./include/linux/spinlock.h:395 net/sched/sch_teql.c:157) [ 238.030071][ T318] __qdisc_destroy (./include/net/pkt_sched.h:328 net/sched/sch_generic.c:1077) [ 238.030077][ T318] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 238.030089][ T318] ? __pfx_qdisc_graft (net/sched/sch_api.c:1091) [ 238.030095][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030102][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030106][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030114][ T318] tc_get_qdisc (net/sched/sch_api.c:1529 net/sched/sch_api.c:1556) ... [ 238.072958][ T318] Allocated by task 303 on cpu 5 at 238.026275s: [ 238.073392][ T318] kasan_save_stack (mm/kasan/common.c:58) [ 238.073884][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.074230][ T318] __kasan_slab_alloc (mm/kasan/common.c:369) [ 238.074578][ T318] kmem_cache_alloc_node_noprof (./include/linux/kasan.h:253 mm/slub.c:4542 mm/slub.c:4869 mm/slub.c:4921) [ 238.076091][ T318] kmalloc_reserve (net/core/skbuff.c:616 (discriminator 107)) [ 238.076450][ T318] __alloc_skb (net/core/skbuff.c:713) [ 238.076834][ T318] alloc_skb_with_frags (./include/linux/skbuff.h:1383 net/core/skbuff.c:6763) [ 238.077178][ T318] sock_alloc_send_pskb (net/core/sock.c:2997) [ 238.077520][ T318] packet_sendmsg (net/packet/af_packet.c:2926 net/packet/af_packet.c:3019 net/packet/af_packet.c:3108) [ 238.081469][ T318] [ 238.081870][ T318] Freed by task 299 on cpu 1 at 238.028496s: [ 238.082761][ T318] kasan_save_stack (mm/kasan/common.c:58) [ 238.083481][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.085348][ T318] kasan_save_free_info (mm/kasan/generic.c:587 (discriminator 1)) [ 238.085900][ T318] __kasan_slab_free (mm/ ---truncated---

The Linux Kernel, the operating system core itself.

Security Fix(es):

IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.(CVE-2025-27558)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ife: Fix metalist update behavior

Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the new metadata. Aside from being innapropriate behavior, this may lead to an unbounded addition of metadata to the metalist which might cause an out of bounds error when running the encode op:

[ 138.423369][ C1] ================================================================== [ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255 [ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full) [ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 138.425800][ C1] Call Trace: [ 138.425804][ C1] <IRQ> [ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122) [ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597) [ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1)) [ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2)) [ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171) [ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57) [ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) [ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3)) [ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45) [ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)

To solve this issue, fix the replace behavior by adding the metalist to the ife rcu data structure.(CVE-2026-23378)

In the Linux kernel, the following vulnerability has been resolved:

icmp: fix NULL pointer dereference in icmp_tag_validation()

icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN:…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

icmp: fix NULL pointer dereference in icmp_tag_validation()

icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: <IRQ> icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) </IRQ>

Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation.(CVE-2026-23398)

In the Linux kernel, the following vulnerability has been resolved:

net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check

The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB.

Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly.

Compile-tested only.(CVE-2026-23447)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: teql: Fix double-free in teql_master_xmit

Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racing with the datapath. Failure to do so may cause crashes like the following:

[ 238.028993][ T318] BUG: KASAN: double-free in skb_release_data (net/core/skbuff.c:1139) [ 238.029328][ T318] Free of addr ffff88810c67ec00 by task poc_teql_uaf_ke/318 [ 238.029749][ T318] [ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: poc_teql_ke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full) [ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 238.029910][ T318] Call Trace: [ 238.029913][ T318] <TASK> [ 238.029916][ T318] dump_stack_lvl (lib/dump_stack.c:122) [ 238.029928][ T318] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 238.029940][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029944][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.029957][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029969][ T318] kasan_report_invalid_free (mm/kasan/report.c:221 mm/kasan/report.c:563) [ 238.029979][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029989][ T318] check_slab_allocation (mm/kasan/common.c:231) [ 238.029995][ T318] kmem_cache_free (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1)) [ 238.030004][ T318] skb_release_data (net/core/skbuff.c:1139) ... [ 238.030025][ T318] sk_skb_reason_drop (net/core/skbuff.c:1256) [ 238.030032][ T318] pfifo_fast_reset (./include/linux/ptr_ring.h:171 ./include/linux/ptr_ring.h:309 ./include/linux/skb_array.h:98 net/sched/sch_generic.c:827) [ 238.030039][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ …

The Linux Kernel, the operating system core itself.

Security Fix(es):

IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.(CVE-2025-27558)

In the Linux kernel, a security vulnerability exists in the IOMMU Shared Virtual Addressing (SVA) feature. On x86 architecture when CONFIG_X86 is set, IOMMU hardware caches kernel page table entries. Due to the lack of notification mechanism for kernel page table changes, when kernel page table pages are freed and reused, the IOMMU may retain stale entries, leading to Use-After-Free (UAF) and Write-After-Free (WAF) conditions. This can be exploited to cause arbitrary physical memory DMA access or privilege escalation.(CVE-2025-71089)

In the Linux kernel, the following vulnerability has been resolved:

uacce: fix cdev handling in the cleanup path

When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove.(CVE-2026-23096)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ife: Fix metalist update behavior

Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the new metadata. Aside from being innapropriate behavior, this may lead to an unbounded addition of metadata to the metalist which might cause an out of bounds error when running the encode op:

[ 138.423369][ C1] ================================================================== [ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255 [ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full) [ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 138.425800][ C1] Call Trace: [ 138.425804][ C1] <IRQ> [ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122) [ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597) [ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1)) [ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2)) [ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171) [ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57) [ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) [ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3)) [ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45) [ 138.425927][ C1] ? srso_alias_return_thunk…

Root has patched CVE-2026-23449 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-23449 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-23449 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2026-23449 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-23449 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teql_master_xmit Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racing with the datapath. Failure to do so may cause crashes like the following: [ 238.028993][ T318] BUG: KASAN: double-free in skb_release_data (net/core/skbuff.c:1139) [ 238.029328][ T318] Free of addr ffff88810c67ec00 by task poc_teql_uaf_ke/318 [ 238.029749][ T318] [ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: poc_teql_ke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full) [ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 238.029910][ T318] Call Trace: [ 238.029913][ T318] <TASK> [ 238.029916][ T318] dump_stack_lvl (lib/dump_stack.c:122) [ 238.029928][ T318] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 238.029940][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029944][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.029957][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029969][ T318] kasan_report_invalid_free (mm/kasan/report.c:221 mm/kasan/report.c:563) [ 238.029979][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029989][ T318] check_slab_allocation (mm/kasan/common.c:231) [ 238.029995][ T318] kmem_cache_free (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1)) [ 238.030004][ T318] skb_release_data (net/core/skbuff.c:1139) ... [ 238.030025][ T318] sk_skb_reason_drop (net/core/skbuff.c:1256) [ 238.030032][ T318] pfifo_fast_reset (./include/linux/ptr_ring.h:171 ./include/linux/ptr_ring.h:309 ./include/linux/skb_array.h:98 net/sched/sch_generic.c:827) [ 238.030039][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.030054][ T318] qdisc_reset (net/sched/sch_generic.c:1034) [ 238.030062][ T318] teql_destroy (./include/linux/spinlock.h:395 net/sched/sch_teql.c:157) [ 238.030071][ T318] __qdisc_destroy (./include/net/pkt_sched.h:328 net/sched/sch_generic.c:1077) [ 238.030077][ T318] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 238.030089][ T318] ? __pfx_qdisc_graft (net/sched/sch_api.c:1091) [ 238.030095][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030102][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030106][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030114][ T318] tc_get_qdisc (net/sched/sch_api.c:1529 net/sched/sch_api.c:1556) ... [ 238.072958][ T318] Allocated by task 303 on cpu 5 at 238.026275s: [ 238.073392][ T318] kasan_save_stack (mm/kasan/common.c:58) [ 238.073884][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.074230][ T318] __kasan_slab_alloc (mm/kasan/common.c:369) [ 238.074578][ T318] kmem_cache_alloc_node_noprof (./include/linux/kasan.h:253 mm/slub.c:4542 mm/slub.c:4869 mm/slub.c:4921) [ 238.076091][ T318] kmalloc_reserve (net/core/skbuff.c:616 (discriminator 107)) [ 238.076450][ T318] __alloc_skb (net/core/skbuff.c:713) [ 238.076834][ T318] alloc_skb_with_frags (./include/linux/skbuff.h:1383 net/core/skbuff.c:6763) [ 238.077178][ T318] sock_alloc_send_pskb (net/core/sock.c:2997) [ 238.077520][ T318] packet_sendmsg (net/packet/af_packet.c:2926 net/packet/af_packet.c:3019 net/packet/af_packet.c:3108) [ 238.081469][ T318] [ 238.081870][ T318] Freed by task 299 on cpu 1 at 238.028496s: [ 238.082761][ T318] kasan_save_stack (mm/kasan/common.c:58) [ 238.083481][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.085348][ T318] kasan_save_free_info (mm/kasan/generic.c:587 (discriminator 1)) [ 238.085900][ T318] __kasan_slab_free (mm/ ---truncated---

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50053: iavf: Fix reset error handling (bsc#1245038).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1. (bsc#1243603).
• CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500 bsc#1262778).
• CVE-2025-68185: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (bsc#1255135).
• CVE-2025-71118: ACPICA: Avoid walking the Namespace if start_node is NULL (bsc#1256763).
• CVE-2025-71238: scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1259186).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23290: net: usb: pegasus: validate USB endpoints (bsc#1260533).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23312: net: usb: kaweth: validate USB endpoints (bsc#1260561).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23378: act_ife: load meta modules before tcf_idr_check_alloc() (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-31393: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (bsc#1261719).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).
• CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).
• CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).
• CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).
• CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).
• CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).
• CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).
• CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).
• CVE-2026-31496: netfilter: nf_conntrack_expect: skip…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2021-47103: inet: fully convert sk->sk_rx_dst to RCU rules (bsc#1221010).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
• CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
• CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651).
• CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).
• CVE-2026-43334: Bluetooth: SMP: force responder MITM…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31528: perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31622: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (bsc#1263797).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-46331: kernel: net/sched: fix pedit partial COW leading to page cache
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43038: ipv6: icmp: clear skb2->cb…

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2021-47103: inet: fully convert sk->sk_rx_dst to RCU rules (bsc#1221010).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
• CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
• CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651).
• CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).
• CVE-2026-43334: Bluetooth: SMP: force responder MITM requirements before building the pairing response (bsc#1265090).
• CVE-2026-43365: xfs: fix undersized l_iclog_roundoff…

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-49979: net: fix refcount bug in sk_psock_get (bsc#1245109).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
• CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
• CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-49979: net: fix refcount bug in sk_psock_get (bsc#1245109).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
• CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
• CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
• CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
• CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323:…

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.28.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.26.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1259134).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1259134).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1259134).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.7.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1259134).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.6.1 fixes various security issues.

The following security issues were fixed:

• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253437).
• CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1259134).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues.

The following security issues were fixed:

• CVE-2025-40204: sctp: Fix MAC comparison to be constant-time (bsc#1253437).
• CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1259134).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.28.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.26.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1259134).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1259134).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues.

The following security issues were fixed:

• CVE-2026-23161: mm/shmem, swap: fix race of truncate and swap entry split (bsc#1259134).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1262213).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263791).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264078).
• CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1265306).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1269282).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264483).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1266668).
• CVE-2026-46037: ipv4: icmp: validate reply type before using icmp_pointers (bsc#1267362).
• CVE-2026-46242: eventpoll: fix ep_remove struct eventpoll / struct file UAF (bsc#1270300).
• CVE-2026-46274: io-wq: check that the predecessor is hashed in io_wq_remove_pending() (bsc#1268624).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268281).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269034).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1272139).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269196).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269822).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269885).
• CVE-2026-53205: accel/ivpu: Add bounds checks for firmware log indices (bsc#1269903).
• CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1270023).
• CVE-2026-53233: netdev: fix double-free in netdev_nl_bind_rx_doit() (bsc#1269803).
• CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1270024).
• CVE-2026-64530: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_hand (bsc#1271867).
• CVE-2026-64600: xfs: resample the data fork mapping after cycling ILOCK (RefluXFS) (bsc#1271543).