CVE-2026-31515

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: fix fanout UAF in packet_release() via NETDEV_UP race

packet_release() has a race window where NETDEV_UP can re-register a socket into a fanout group's arr[] array. The re-registration is not cleaned up by fanout_release(), leaving a dangling pointer in the fanout array. packet_release() does NOT zero po->num in its bind_lock section. After releasing bind_lock, po->num is still non-zero and po->ifindex still matches the bound device. A concurrent packet_notifier(NETDEV_UP) that already found the socket in sklist can re-register the hook. For fanout sockets, this re-registration calls __fanout_link(sk, po) which adds the socket back into f->arr[] and increments f->num_members, but does NOT increment f->sk_ref.

The fix sets po->num to zero in packet_release while bind_lock is held to prevent NETDEV_UP from linking, preventing the race window.

This bug was found following an additional audit with Claude Code based on CVE-2025-38617.(CVE-2026-31504)

In the Linux kernel, the following vulnerability has been resolved:

af_key: validate families in pfkey_send_migrate()

syzbot was able to trigger a crash in skb_put() [1]

Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.

Validate families early, do not wait set_ipsecrequest().

[1]

skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150(CVE-2026-31515)

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: proc: size address buffers for %pISpc output

The AF_RXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with "%pISpc".

That is too small for the longest current-tree IPv6-with-port form the formatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a dotted-quad tail not only for v4mapped addresses, but also for ISATAP addresses via ipv6_addr_is_isatap().

As a result, a case such as

is possible with the current formatter. That is 50 visible characters, so 51 bytes including the trailing NUL, which does not fit in the existing char[50] buffers used by net/rxrpc/proc.c.

Size the buffers from the formatter's maximum textual form and switch the call sites to scnprintf().

Changes since v1:

• correct the changelog to cite the actual maximum current-tree case explicitly
• frame the proof around the ISATAP formatting path instead of the earlier mapped-v4 example(CVE-2026-31630)

In the Linux kernel, the following vulnerability has been resolved:

af_unix: read UNIX_DIAG_VFS data under unix_state_lock

Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking.

Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock.

This keeps the VFS data stable while the reply is being built.(CVE-2026-31673)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()

Reject…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Return the correct value in vmw_translate_ptr functions

Before the referenced fixes these functions used a lookup function that returned a pointer. This was changed to another lookup function that returned an error code with the pointer becoming an out parameter.

The error path when the lookup failed was not changed to reflect this change and the code continued to return the PTR_ERR of the now uninitialized pointer. This could cause the vmw_translate_ptr functions to return success when they actually failed causing further uninitialized and OOB accesses.(CVE-2026-23317)

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Defer sub-object cleanup in export put callbacks

svc_export_put() calls path_put() and auth_domain_put() immediately when the last reference drops, before the RCU grace period. RCU readers in e_show() and c_show() access both ex_path (via seq_path/d_path) and ex_client->name (via seq_escape) without holding a reference. If cache_clean removes the entry and drops the last reference concurrently, the sub-objects are freed while still in use, producing a NULL pointer dereference in d_path.

Commit 2530766492ec ("nfsd: fix UAF when access ex_uuid or ex_stats") moved kfree of ex_uuid and ex_stats into the call_rcu callback, but left path_put() and auth_domain_put() running before the grace period because both may sleep and call_rcu callbacks execute in softirq context.

Replace call_rcu/kfree_rcu with queue_rcu_work(), which defers the callback until after the RCU grace period and executes it in process context where sleeping is permitted. This allows path_put() and auth_domain_put() to be moved into the deferred callback alongside the other resource releases. Apply the same fix to expkey_put(), which has the identical pattern with ek_path and ek_client.

A dedicated workqueue scopes the shutdown drain to only NFSD export release work items; flushing the shared system_unbound_wq would stall on unrelated work from other subsystems. nfsd_export_shutdown() uses rcu_barrier() followed by flush_workqueue() to ensure all deferred release callbacks complete before the export caches are destroyed.

Reviwed-by: Jeff Layton <(CVE-2026-31404)

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: fix use-after-free in bond_xmit_broadcast()

bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed).

Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations.

The UAF can trigger the following crash:

================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147

CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()

At the end of this function, d is the traversal cursor of flist, but the code completes found instead. This can lead to issues such as NULL pointer dereferences, double completion, or descriptor leaks.

Fix this by completing d instead of found in the final list_for_each_entry_safe() loop.(CVE-2026-31436)

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/core) Protect regulator operations with mutex

The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions.

However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex.

Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker.

Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset().

While at it, remove the unnecessary include of linux/of.h.(CVE-2026-31486)

In the Linux kernel, the following vulnerability has been resolved:

net: fix fanout UAF in packet_release() via NETDEV_UP race

packet_release() has a race window where NETDEV_UP can re-register a socket into a fanout group's arr[] array. The re-registration is not cleaned up by fanout_release(), leaving a dangling pointer in the fanout array. packet_release() does NOT zero po->num in its bind_lock section. After releasing bind_lock, po->num is still non-zero and po->ifindex still matches the bound device. A concurrent packet_notifier(NETDEV_UP) that already found the socket in sklist can re-register the hook. For fanout sockets, this re-registration calls __fanout_link(sk, po) which adds the socket back into f->arr[] and increments f->num_members, but does NOT increment f->sk_ref.

The fix sets po->num to zero in packet_release while bind_lock is held to prevent NETDEV_UP from linking, preventing the race window.

This bug was found following an additional audit with Claude Code based on CVE-2025-38617.(CVE-2026-31504)

In the Linux kernel, the following vulnerability has been resolved:

af_key: validate families in pfkey_send_migrate()

syzbot was able to trigger a crash in skb_put() [1]

Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.

Validate families early, do not wait set_ipsecrequest().

[1]

skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150(CVE-2026-31515)

In the Linux kernel, the following vulnerability has been resolved:

mm/userfaultfd: fix hugetlb fault mutex hash calculation

In mfill_atomic_hugetlb(),…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()

At the end of this function, d is the traversal cursor of flist, but the code completes found instead. This can lead to issues such as NULL pointer dereferences, double completion, or descriptor leaks.

Fix this by completing d instead of found in the final list_for_each_entry_safe() loop.(CVE-2026-31436)

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/core) Protect regulator operations with mutex

The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions.

However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex.

Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker.

Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset().

While at it, remove the unnecessary include of linux/of.h.(CVE-2026-31486)

In the Linux kernel, the following vulnerability has been resolved:

net: fix fanout UAF in packet_release() via NETDEV_UP race

packet_release() has a race window where NETDEV_UP can re-register a socket into a fanout group's arr[] array. The re-registration is not cleaned up by fanout_release(), leaving a dangling pointer in the fanout array. packet_release() does NOT zero po->num in its bind_lock section. After releasing bind_lock, po->num is still non-zero and po->ifindex still matches the bound device. A concurrent packet_notifier(NETDEV_UP) that already found the socket in sklist can re-register the hook. For fanout sockets, this re-registration calls __fanout_link(sk, po) which adds the socket back into f->arr[] and increments f->num_members, but does NOT increment f->sk_ref.

The fix sets po->num to zero in packet_release while bind_lock is held to prevent NETDEV_UP from linking, preventing the race window.

This bug was found following an additional audit with Claude Code based on CVE-2025-38617.(CVE-2026-31504)

In the Linux kernel, the following vulnerability has been resolved:

af_key: validate families in pfkey_send_migrate()

syzbot was able to trigger a crash in skb_put() [1]

Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.

Validate families early, do not wait set_ipsecrequest().

[1]

skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150(CVE-2026-31515)

In the Linux kernel, the following vulnerability has been resolved:

mm/userfaultfd: fix hugetlb fault mutex hash calculation

In mfill_atomic_hugetlb(),…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()

At the end of this function, d is the traversal cursor of flist, but the code completes found instead. This can lead to issues such as NULL pointer dereferences, double completion, or descriptor leaks.

Fix this by completing d instead of found in the final list_for_each_entry_safe() loop.(CVE-2026-31436)

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (pmbus/core) Protect regulator operations with mutex

The regulator operations pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage() access PMBus registers and shared data but were not protected by the update_lock mutex. This could lead to race conditions.

However, adding mutex protection directly to these functions causes a deadlock because pmbus_regulator_notify() (which calls regulator_notifier_call_chain()) is often called with the mutex already held (e.g., from pmbus_fault_handler()). If a regulator callback then calls one of the now-protected voltage functions, it will attempt to acquire the same mutex.

Rework pmbus_regulator_notify() to utilize a worker function to send notifications outside of the mutex protection. Events are stored as atomics in a per-page bitmask and processed by the worker.

Initialize the worker and its associated data during regulator registration, and ensure it is cancelled on device removal using devm_add_action_or_reset().

While at it, remove the unnecessary include of linux/of.h.(CVE-2026-31486)

In the Linux kernel, the following vulnerability has been resolved:

net: fix fanout UAF in packet_release() via NETDEV_UP race

packet_release() has a race window where NETDEV_UP can re-register a socket into a fanout group's arr[] array. The re-registration is not cleaned up by fanout_release(), leaving a dangling pointer in the fanout array. packet_release() does NOT zero po->num in its bind_lock section. After releasing bind_lock, po->num is still non-zero and po->ifindex still matches the bound device. A concurrent packet_notifier(NETDEV_UP) that already found the socket in sklist can re-register the hook. For fanout sockets, this re-registration calls __fanout_link(sk, po) which adds the socket back into f->arr[] and increments f->num_members, but does NOT increment f->sk_ref.

The fix sets po->num to zero in packet_release while bind_lock is held to prevent NETDEV_UP from linking, preventing the race window.

This bug was found following an additional audit with Claude Code based on CVE-2025-38617.(CVE-2026-31504)

In the Linux kernel, the following vulnerability has been resolved:

af_key: validate families in pfkey_send_migrate()

syzbot was able to trigger a crash in skb_put() [1]

Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.

Validate families early, do not wait set_ipsecrequest().

[1]

skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150(CVE-2026-31515)

In the Linux kernel, the following vulnerability has been resolved:

mm/userfaultfd: fix hugetlb fault mutex hash calculation

In mfill_atomic_hugetlb(),…

Root has patched CVE-2026-31515 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-31515 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-31515 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-31515 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: af_key: validate families in pfkey_send_migrate() syzbot was able to trigger a crash in skb_put() [1] Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb. Validate families early, do not wait set_ipsecrequest(). [1] skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150

In the Linux kernel, the following vulnerability has been resolved:

af_key: validate families in pfkey_send_migrate()

syzbot was able to trigger a crash in skb_put() [1]

Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.

Validate families early, do not wait set_ipsecrequest().

[1]

skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150

• rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
• xfrm: esp: avoid in-place decrypt on shared skb frags
• clk: Fix clk_hw_get_clk() when dev is NULL {CVE-2022-49187}
• x86/sgx: Add overflow check in sgx_validate_offset_length() {CVE-2022-49785}
• ext4: init quota for 'old.inode' in 'ext4_rename' {CVE-2022-50346}
• skbuff: Account for tail adjustment during pull operations {CVE-2022-50365}
• net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory {CVE-2022-50409}
• scsi: qla2xxx: Delay module unload while fabric scan in progress {CVE-2025-71235}
• HID: alps: fix NULL pointer dereference in alps_raw_event() {CVE-2026-31625}
• rxrpc: fix reference count leak in rxrpc_server_keyring() {CVE-2026-31634}
• drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
• ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects {CVE-2023-54010}
• drm/amdgpu: fix the waring dereferencing hive {CVE-2024-46805}
• drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func {CVE-2024-49911}
• tracing: Prevent bad count for tracing_cpumask_write {CVE-2024-56763}
• HID: wacom: fix when get product name maybe null pointer {CVE-2024-56629}
• thermal: int340x: Add NULL check for adev {CVE-2025-23136}
• wifi: mac80211: Purge vif txq in ieee80211_do_stop() {CVE-2025-37794}
• Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
• wifi: cfg80211: ocb: don't leave if not joined {CVE-2023-53992}
• mmc: core: Fix kernel panic when remove non-standard SDIO card {CVE-2022-50640}
• EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() {CVE-2022-50645}
• serial: amba-pl011: avoid SBSA UART accessing DMACR register {CVE-2022-50625}
• inet_diag: Initialize pad field in struct inet_diag_req_v2 {CVE-2024-42106}
• regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt {CVE-2022-49481}
• net/core: Fix ETH_P_1588 flow dissector {CVE-2023-52580}
• mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() {CVE-2023-52560}
• af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg {CVE-2024-38596}
• drm/amd/display: Implement bounds check for stream encoder creation in DCN301 {CVE-2024-26660}
• block: prevent division by zero in blk_rq_stat_sum() {CVE-2024-35925}
• netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286}
• tipc: fix a possible memleak in tipc_buf_append {CVE-2024-36954}
• ipv6: prevent possible NULL deref in fib6_nh_init() {CVE-2024-40961}
• pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER {CVE-2024-42090}
• ipv6: prevent possible NULL dereference in rt6_probe() {CVE-2024-40960}
• drm/radeon: check bo_va->bo is non-NULL before using it {CVE-2024-41060}
• dma: fix call order in dmam_free_coherent {CVE-2024-43856}
• scsi: qla2xxx: Fix for possible memory corruption {CVE-2024-42288}
• ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt {CVE-2024-26774}
• netfilter: flowtable: incorrect pppoe tuple {CVE-2024-27015}
• bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() {CVE-2024-40919}
• Bluetooth: btintel: Fix null ptr deref in btintel_read_version {CVE-2024-35933}
• netdevsim: prevent bad user input in nsim_dev_health_break_write() {CVE-2024-56716}
• net/mlx5e: CT: Fix null-ptr-deref in add rule err flow {CVE-2024-53120}
• EDAC/bluefield: Fix potential integer overflow {CVE-2024-53161}
• NFSD: Prevent NULL dereference in nfsd4_process_cb_update() {CVE-2024-53217}
• ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() {CVE-2024-50304}
• blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race {CVE-2024-50082}
• drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
• HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
• filemap: Fix bounds checking in filemap_read()…

• ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
• tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
• mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
• cpuset: fix warning when disabling remote partition {CVE-2025-71142}
• virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
• netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
• atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
• idpf: fix error handling in the init_task on load {CVE-2026-23017}
• rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
• block: zero non-PI portion of auto integrity buffer {CVE-2026-23007}
• can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
• virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
• net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
• gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
• KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
• ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
• RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
• RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
• scsi: qla2xxx: Validate sp before freeing associated memory {CVE-2025-71236}
• net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
• drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
• iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
• net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
• can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
• Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
• ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}
• drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
• mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
• lib/buildid: use __kernel_read() for sleepable context {CVE-2026-23002}
• scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• irqchip/imx-irqsteer: Handle runtime power management correctly {CVE-2024-42290}
• io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop {CVE-2026-23113}
• net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
• net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• net: USB: Fix wrong-direction WARNING in plusb.c {CVE-2023-52742}
• module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
• udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
• net/mlx5: qos: Restrict RTNL area to avoid a lock cycle {CVE-2025-39947}
• scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• nfsd: check that server is running in unlock_filesystem {CVE-2026-22989}
• af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
• netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286} -…

In the Linux kernel, the following vulnerability has been resolved:

af_key: validate families in pfkey_send_migrate()

syzbot was able to trigger a crash in skb_put() [1]

Issue is that pfkey_send_migrate() does not check old/new families, and that set_ipsecrequest() @family argument was truncated, thus possibly overfilling the skb.

Validate families early, do not wait set_ipsecrequest().

[1]

skbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:<NULL> kernel BUG at net/core/skbuff.c:214 ! Call Trace: <TASK> skb_over_panic net/core/skbuff.c:219 [inline] skb_put+0x159/0x210 net/core/skbuff.c:2655 skb_put_zero include/linux/skbuff.h:2788 [inline] set_ipsecrequest net/key/af_key.c:3532 [inline] pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636 km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848 xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705 xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150

Upstream kernel version 6.6.137 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.6.137 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
• CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
• CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: Add workaround for Cortex-A76 erratum 1286807 (bsc#1266290).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23279: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (bsc#1260468).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23367: wifi: radiotap: reject radiotap with unknown bits (bsc#1260731).
• CVE-2026-23396: wifi: mac80211: fix NULL deref in mesh_matches_local() (bsc#1260729).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-23448: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (bsc#1261750).
• CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
• CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).
• CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).
• CVE-2026-31447: ext4: reject mount if bigalloc with s_first_data_block != 0 (bsc#1262614).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31498: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (bsc#1262751).
• CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
• CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31532: can: af_can: export can_sock_destruct() (bsc#1262757).
• CVE-2026-31540: drm/i915/gt: Check set_default_submission() before deferencing (bsc#1263011).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
• CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
• CVE-2026-31778: ALSA: caiaq: fix stack out-of-bounds read in init_card (bsc#1263923).
• CVE-2026-43020: Bluetooth: MGMT: validate LTK enc_size on load (bsc#1264006).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb in…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Framebuffer layer;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• SMB network file system;
• SquashFS file system;
• XFS file system;
• Audit subsystem;
• RAS (Reliability, Availability, Serviceability) subsystem;
• CPU frequency scaling framework;
• Memory Management;
• KVM subsystem;
• Memory management;
• Network traffic control;
• Netfilter;
• IP tunnels definitions;
• Tracing infrastructure;
• User-space API (UAPI);
• io_uring subsystem;
• BPF subsystem;
• Control group (cgroup);
• Kernel fork() syscall;
• Kernel futex primitives;
• Kernel kexec() syscall;
• Kernel module support;
• Scheduler…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• RNBD block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• MediaTek SoC drivers;
• Microchip PolarFire SoC system controller driver;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• RNBD block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• MediaTek SoC drivers;
• Microchip PolarFire SoC system controller driver;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• RNBD block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• MediaTek SoC drivers;
• Microchip PolarFire SoC system controller driver;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• RNBD block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• MediaTek SoC drivers;
• Microchip PolarFire SoC system controller driver;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare…