CVE-2026-31511

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

This fixes the condition checking so mgmt_pending_valid is executed whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd) would kfree(cmd) without unlinking it from the list first, leaving a dangling pointer. Any subsequent list traversal (e.g., mgmt_pending_foreach during __mgmt_power_off, or another mgmt_pending_valid call) would dereference freed memory.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.13%Up 0.1 points since Apr 23, 2026

What each source reports

CVE List Score used 7.8

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

Record: CVE-2026-31511
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2026-24893 7.8

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

Record: EUVD-2026-24893
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-q648-4769-6m83 7.8

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix...

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

Record: GHSA-q648-4769-6m83
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

Record: CVE-2026-31511
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2026-31511 7.8

Record: BELL-CVE-2026-31511
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

Record: CVE-2026-31511
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 32 moreShow less

OSVDEBIAN-CVE-2026-31511 7.8

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete This fixes the condition checking so mgmt_pending_valid is executed whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd) would kfree(cmd) without unlinking it from the list first, leaving a dangling pointer. Any subsequent list traversal (e.g., mgmt_pending_foreach during __mgmt_power_off, or another mgmt_pending_valid call) would dereference freed memory.

Record: DEBIAN-CVE-2026-31511
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-2581 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: Prevent parser TCAM memory corruption

Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications.

Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means that operations must be atomic in order to, e.g., avoid spreading writes across multiple rows. Since the shadow SRAM array is used to find free rows in the hardware table, it must also be protected in order to avoid TOCTOU errors where multiple cores allocate the same row.

This issue was detected in a situation where mvpp2_set_rx_mode() ran concurrently on two CPUs. In this particular case the MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the classifier unit to drop all incoming unicast - indicated by the rx_classifier_drops counter.(CVE-2025-22060)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix NULL pointer in can_accept_new_subflow

When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL.

Call trace:

mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./net/mptcp/subflow.c:854) tcp_check_req (./net/ipv4/tcp_minisocks.c:863) tcp_v4_rcv (./net/ipv4/tcp_ipv4.c:2268) ip_protocol_deliver_rcu (./net/ipv4/ip_input.c:207) ip_local_deliver_finish (./net/ipv4/ip_input.c:234) ip_local_deliver (./net/ipv4/ip_input.c:254) ip_rcv_finish (./net/ipv4/ip_input.c:449) ...

According to the debug log, the same req received two SYN-ACK in a very short time, very likely because the client retransmits the syn ack due to multiple reasons.

Even if the packets are transmitted with a relevant time interval, they can be processed by the server on different CPUs concurrently). The 'subflow_req->msk' ownership is transferred to the subflow the first, and there will be a risk of a null pointer dereference here.

This patch fixes this issue by moving the 'subflow_req->msk' under the own_req == true conditional.

Note that the !msk check in subflow_hmac_valid() can be dropped, because the same check already exists under the own_req mpj branch where the code has been moved to.(CVE-2025-23145)

In the Linux kernel, the following vulnerability has been resolved:

mISDN: hfcpci: Fix warning when deleting uninitialized timer

With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat:

Record: OESA-2026-2581
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-2582 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mISDN: hfcpci: Fix warning when deleting uninitialized timer

With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat:

[ 250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0 [ 250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0 [ 250.218775] Modules linked in: hfcpci(-) mISDN_core [ 250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary) [ 250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0 [ 250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d [ 250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286 [ 250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95 [ 250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0 [ 250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39 [ 250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001 [ 250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8 [ 250.232454] FS: 00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000 [ 250.233851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0 [ 250.236117] Call Trace: [ 250.236599] <TASK> [ 250.236967] ? trace_irq_enable.constprop.0+0xd4/0x130 [ 250.237920] debug_object_assert_init+0x1f6/0x310 [ 250.238762] ? __pfx_debug_object_assert_init+0x10/0x10 [ 250.239658] ? __lock_acquire+0xdea/0x1c70 [ 250.240369] __try_to_del_timer_sync+0x69/0x140 [ 250.241172] ? __pfx___try_to_del_timer_sync+0x10/0x10 [ 250.242058] ? __timer_delete_sync+0xc6/0x120 [ 250.242842] ? lock_acquire+0x30/0x80 [ 250.243474] ? __timer_delete_sync+0xc6/0x120 [ 250.244262] __timer_delete_sync+0x98/0x120 [ 250.245015] HFC_cleanup+0x10/0x20 [hfcpci] [ 250.245704] __do_sys_delete_module+0x348/0x510 [ 250.246461] ? __pfx___do_sys_delete_module+0x10/0x10 [ 250.247338] do_syscall_64+0xc1/0x360 [ 250.247924] entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fix this by initializing hfc_tl timer with DEFINE_TIMER macro. Also, use mod_timer instead of manual timeout update.(CVE-2025-39833)

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Add support for Van Gogh SoC

The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix suspend.

Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver to crash while trying to resume afterwards due to a power hang.(CVE-2025-68334)

In the Linux kernel, the following vulnerability has been resolved:

team: Move team device type change at the end of team_port_add

Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops.

In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change.

Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense as the private data of the device still holds a struct team.

Example sequence of iproute2 commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0…

Record: OESA-2026-2582
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2026-31511 6.1

CVE-2026-31511 in linux - Patched by Root

Root has patched CVE-2026-31511 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-31511
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-31511 7.8

Record: UBUNTU-CVE-2026-31511
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-11

OSVCLSA-2026-1792751700 No score

kernel: Fix of 106 CVEs

net: skbuff: propagate shared-frag marker in skb_zerocopy()
net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
ALSA: virtio: reset device before deleting virtqueues {CVE-2026-98264}
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047}
SUNRPC: Fix a server shutdown leak {CVE-2023-53131}
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
wifi: mwifiex: validate scan response extents {CVE-2026-98185}
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}
qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info {CVE-2023-53066}
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count {CVE-2026-64277}
dmaengine: Fix possible use after free {CVE-2026-72476}
netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state {CVE-2026-93288}
mpls: add seqcount to protect the platform_label{,s} pair {CVE-2026-43042}
Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540}
usb: dwc2: Fix use after free in debug code {CVE-2026-63927}
KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path {CVE-2026-63794}
KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
x86/mm/ident_map: Use gbpages only where full GB page should be mapped. {CVE-2024-50017}
crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}
i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
RDMA/ucma: Lock the handler in ucma_set_ib_path() {CVE-2026-89508}
RDMA/srpt: fix integer overflow in immediate data length check {CVE-2026-74394}
dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
veth: fix NAPI leak in XDP enable error path {CVE-2026-80613}
net: hns3: fix kernel crash when 1588 is received on HIP08 devices {CVE-2024-26881}
ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
net: mana: validate rx_req_idx to prevent out-of-bounds array access {CVE-2026-64018}
net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830}
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() {CVE-2026-63993}
wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847}
fs/mbcache: cancel…

Record: CLSA-2026-1792751700
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21555-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: openSUSE-SU-2026:21555-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23066-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: SUSE-SU-2026:23066-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23068-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: SUSE-SU-2026:23068-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23193-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
CVE-2026-46040: inotify:…

Record: SUSE-SU-2026:23193-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23194-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
CVE-2026-46040: inotify: fix…

Record: SUSE-SU-2026:23194-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23221-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: SUSE-SU-2026:23221-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23231-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: SUSE-SU-2026:23231-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23237-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: SUSE-SU-2026:23237-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23241-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
CVE-2026-46040: inotify:…

Record: SUSE-SU-2026:23241-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23244-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
CVE-2026-46040: inotify: fix…

Record: SUSE-SU-2026:23244-1
Updated: 2026-11-02

OSVSUSE-SU-2026:3130-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593 bsc#1264419).
CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).
CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805). -…

Record: SUSE-SU-2026:3130-1
Updated: 2026-11-02

OSVSUSE-SU-2026:3166-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593 bsc#1264419).
CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).
CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805). -…

Record: SUSE-SU-2026:3166-1
Updated: 2026-11-02

OSVUSN-8567-1 No score

linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)