CVE-2026-31520

HID: apple: avoid memory leak in apple_report_fixup()

5.5 MediumFix available

What does this mean?

: 5.5v3.1, from NVD
: 0.12%2nd percentile
Fixed in: 6.6.134.1-2kernel
Published: April 22, 2026
Modified: November 11, 2026
Weakness: CWE-401
Also known as: AZL-83285BELL-CVE-2026-31520CLSA-2026-1786350974CLSA-2026-1786352940DEBIAN-CVE-2026-31520EUVD-2026-24905GHSA-j7qm-9792-fvr5MGASA-2026-0108
Show 31 moreShow less
MGASA-2026-0110ROOT-OS-DEBIAN-12-CVE-2026-31520ROOT-OS-UBUNTU-2204-CVE-2026-31520ROOT-OS-UBUNTU-2404-CVE-2026-31520SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23193-1SUSE-SU-2026:23194-1SUSE-SU-2026:23221-1SUSE-SU-2026:23231-1SUSE-SU-2026:23237-1SUSE-SU-2026:23241-1SUSE-SU-2026:23244-1SUSE-SU-2026:3130-1SUSE-SU-2026:3166-1UBUNTU-CVE-2026-31520USN-8567-1USN-8574-1USN-8574-2USN-8574-3USN-8595-1USN-8595-2USN-8595-3USN-8596-1USN-8606-1USN-8607-1USN-8608-1USN-8609-1USN-8619-1USN-8665-1openSUSE-SU-2026:21555-1

In the Linux kernel, the following vulnerability has been resolved:

HID: apple: avoid memory leak in apple_report_fixup()

The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.

The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.12%Up 0.1 points since Apr 23, 2026

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

HID: apple: avoid memory leak in apple_report_fixup()

The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.

The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

Record: CVE-2026-31520
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-401
Updated: 2026-11-05

CVE List No score

HID: apple: avoid memory leak in apple_report_fixup()

In the Linux kernel, the following vulnerability has been resolved:

HID: apple: avoid memory leak in apple_report_fixup()

The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.

The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

Record: CVE-2026-31520
Updated: 2026-11-05

EUVDEUVD-2026-24905 No score

In the Linux kernel, the following vulnerability has been resolved:

HID: apple: avoid memory leak in apple_report_fixup()

The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.

The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

Record: EUVD-2026-24905
Updated: 2026-11-05

GitHub AdvisoriesGHSA-j7qm-9792-fvr5 5.5

In the Linux kernel, the following vulnerability has been resolved: HID: apple: avoid memory...

In the Linux kernel, the following vulnerability has been resolved:

HID: apple: avoid memory leak in apple_report_fixup()

The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.

The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

Record: GHSA-j7qm-9792-fvr5
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-401
Updated: 2026-11-02

OSVBELL-CVE-2026-31520 5.5

Record: BELL-CVE-2026-31520
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-31520 5.5

In the Linux kernel, the following vulnerability has been resolved: HID: apple: avoid memory leak in apple_report_fixup() The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it. The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

Record: DEBIAN-CVE-2026-31520
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

Show 36 moreShow less

OSVROOT-OS-DEBIAN-12-CVE-2026-31520 5.5

CVE-2026-31520 in linux - Patched by Root

Root has patched CVE-2026-31520 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-31520
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-31520 5.5

CVE-2026-31520 in linux - Patched by Root

Root has patched CVE-2026-31520 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-31520
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2026-31520 5.5

CVE-2026-31520 in linux - Patched by Root

Root has patched CVE-2026-31520 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-31520
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-31520 2.4

Record: UBUNTU-CVE-2026-31520
CVSS 4.0: 2.4 LowCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVAZL-83285 No score

CVE-2026-31520 affecting package kernel for versions less than 6.6.134.1-2

In the Linux kernel, the following vulnerability has been resolved:

HID: apple: avoid memory leak in apple_report_fixup()

The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.

The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

Record: AZL-83285
Updated: 2026-11-02

OSVCLSA-2026-1786350974 No score

kernel: Fix of 119 CVEs

KVM: x86: Check for invalid/obsolete root after making MMU pages available {CVE-2026-64561}
KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level {CVE-2026-63807}
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak {CVE-2025-40035}
thunderbolt: Limit XDomain response copy to actual frame size {CVE-2026-53146}
drm/gud: Fix UBSAN warning {CVE-2022-50628}
wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests {CVE-2023-54108}
fs: udf: fix OOB read in lengthAllocDescs handling {CVE-2025-40044}
tipc: Fix use-after-free in tipc_mon_reinit_self(). {CVE-2025-40280}
isofs: Fix out of bound access for corrupted isofs image {CVE-2021-47478}
pppoe: drop PFC frames {CVE-2026-53003}
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free {CVE-2026-46304}
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery {CVE-2026-43466}
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails {CVE-2026-45997}
irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions {CVE-2022-49716}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
can: dev: can_set_termination(): allow sleeping GPIOs {CVE-2024-56625}
cxl/mem: Fix shutdown order {CVE-2023-52849}
pinctrl: check the return value of pinmux_ops::get_function_name() {CVE-2025-40030}
usb: usbtmc: Flush anchored URBs in usbtmc_release {CVE-2026-31758}
RDMA/siw: Fix potential NULL pointer dereference in header processing {CVE-2026-23242}
ASoC: wm_adsp: Fix NULL dereference when removing firmware controls {CVE-2026-53350}
net: bcmgenet: fix off-by-one in bcmgenet_put_txcb {CVE-2026-53088}
HID: multitouch: Check to ensure report responses match the request {CVE-2026-43047}
can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23058}
firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle {CVE-2023-53250}
usb: storage: Fix memory leak in USB bulk transport {CVE-2025-68288}
wifi: rtw88: check for PCI upstream bridge existence {CVE-2026-46092}
crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed {CVE-2026-31697}
scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() {CVE-2022-48650}
HID: apple: avoid memory leak in apple_report_fixup() {CVE-2026-31520}
HID: magicmouse: avoid memory leak in magicmouse_report_fixup() {CVE-2026-31522}
scsi: qla2xxx: Avoid fcport pointer dereference {CVE-2023-53603}
RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() {CVE-2026-46178}
scsi: mpi3mr: Add NULL checks when resetting request and reply queues {CVE-2026-43473}
HID: roccat: fix use-after-free in roccat_report_event {CVE-2026-43111}
tap: free page on error paths in tap_get_user_xdp() {CVE-2026-46320}
net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode {CVE-2026-43180}
usb: xhci: Fix memory leak in xhci_disable_slot() {CVE-2026-43432}
PCI: Fix reset_method_store() memory leak {CVE-2024-56745}
rbd: fix null-ptr-deref when device_add_disk() fails {CVE-2026-46079}
net: stmmac: fix integer underflow in chain mode {CVE-2026-31649}
be2net: pass wrb_params in case of OS2BMC {CVE-2025-40264}
thunderbolt: Validate XDomain request packet size before type cast {CVE-2026-53147}
Input: uinput - fix circular locking dependency with ff-core {CVE-2026-31667}
usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency {CVE-2023-52855}
nbd: defer config put in recv_work {CVE-2025-68372}
net: hns3: using the num_tqps in the vf driver to apply for resources {CVE-2025-71064}
serial: imx: fix tx statemachine deadlock {CVE-2023-52456}
bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave() {CVE-2024-47734}
dm-thin: fix metadata refcount underflow {CVE-2026-46107}
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering…

Record: CLSA-2026-1786350974
Updated: 2026-11-02

OSVCLSA-2026-1786352940 No score

kernel: Fix of 148 CVEs

KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level {CVE-2026-63807}
KVM: x86: Check for invalid/obsolete root after making MMU pages available {CVE-2026-64561}
ubi: Fix use-after-free when volume resizing failed {CVE-2023-53271}
ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() {CVE-2025-37912}
wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() {CVE-2026-53318}
dpll: Prevent duplicate registrations {CVE-2026-23129}
pinmux: fix race causing mux_owner NULL with active mux_usecount {CVE-2025-38632}
HID: apple: validate feature-report field count to prevent NULL pointer dereference {CVE-2025-38557}
thunderbolt: Limit XDomain response copy to actual frame size {CVE-2026-53146}
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery {CVE-2026-43466}
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false {CVE-2026-31469}
scsi: target: Reset t_task_cdb pointer in error case {CVE-2025-68782}
ubi: ubi_create_volume: Fix use-after-free when volume creation failed {CVE-2022-49388}
drm/xe/reg_sr: Fix leak on xa_store failure {CVE-2026-23418}
ASoC: soc-core: flush delayed work before removing DAIs and widgets {CVE-2026-43459}
md/raid10: wait barrier before returning discard request with REQ_NOWAIT {CVE-2025-40325}
nbd: defer config put in recv_work {CVE-2025-68372}
nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference {CVE-2026-23148}
net: hns3: using the num_tqps in the vf driver to apply for resources {CVE-2025-71064}
net/mlx5e: Disable MACsec offload for uplink representor profile {CVE-2025-38020}
serial: imx: fix tx statemachine deadlock {CVE-2023-52456}
dm-thin: fix metadata refcount underflow {CVE-2026-46107}
net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure {CVE-2026-53229}
drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
usbnet:fix NPE during rx_complete {CVE-2025-22050}
platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it {CVE-2025-21645}
driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() {CVE-2025-21810}
usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
ALSA: seq: dummy: fix UMP event stack overread {CVE-2026-53241}
pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled {CVE-2026-31655}
net/mlx5: Bridge, fix the crash caused by LAG state check {CVE-2025-21970}
ALSA: timer: Don't take register_mutex with copy_from/to_user() {CVE-2025-23134}
md/raid5: validate payload size before accessing journal metadata {CVE-2026-46070}
nvmet-fc: move lsop put work to nvmet_fc_ls_req_op {CVE-2025-40171}
iommu: Fix potential memory leak in iopf_queue_remove_device() {CVE-2025-21770}
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak {CVE-2025-40035}
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails {CVE-2026-45997}
can: dev: can_set_termination(): allow sleeping GPIOs {CVE-2024-56625}
nvme-tcp: fix the memleak while create new ctrl failed {CVE-2024-56632}
ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() {CVE-2026-46146}
pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains {CVE-2026-23187}
wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path {CVE-2025-22128}
octeon_ep: Fix memory leak in octep_device_setup() {CVE-2026-23160}
pinctrl: check the return value of pinmux_ops::get_function_name() {CVE-2025-40030}
net: tun: fix tun_napi_alloc_frags() {CVE-2024-56372}
wifi: iwlwifi: mvm: clean up ROC on failure {CVE-2025-21906}
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275}
dpll: fix xa_alloc_cyclic() error handling {CVE-2025-22016}
usb: usbtmc: Flush anchored URBs in usbtmc_release {CVE-2026-31758}
RDMA/siw: Fix potential NULL pointer dereference in header processing…

Record: CLSA-2026-1786352940
Updated: 2026-11-02

OSV No score

HID: apple: avoid memory leak in apple_report_fixup()

In the Linux kernel, the following vulnerability has been resolved:

HID: apple: avoid memory leak in apple_report_fixup()

The apple_report_fixup() function was returning a newly kmemdup()-allocated buffer, but never freeing it.

The caller of report_fixup() does not take ownership of the returned pointer, but it is permitted to return a sub-portion of the input rdesc, whose lifetime is managed by the caller.

Record: CVE-2026-31520
Updated: 2026-11-07

OSVMGASA-2026-0108 No score

Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.137 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Record: MGASA-2026-0108
Updated: 2026-11-02

OSVMGASA-2026-0110 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.137 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0110
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21555-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: openSUSE-SU-2026:21555-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23066-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: SUSE-SU-2026:23066-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23068-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: SUSE-SU-2026:23068-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23193-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
CVE-2026-46040: inotify:…

Record: SUSE-SU-2026:23193-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23194-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
CVE-2026-46040: inotify: fix…

Record: SUSE-SU-2026:23194-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23221-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: SUSE-SU-2026:23221-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23231-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: SUSE-SU-2026:23231-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23237-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer…

Record: SUSE-SU-2026:23237-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23241-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
CVE-2026-46040: inotify:…

Record: SUSE-SU-2026:23241-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23244-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
CVE-2026-46040: inotify: fix…

Record: SUSE-SU-2026:23244-1
Updated: 2026-11-02

OSVSUSE-SU-2026:3130-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593 bsc#1264419).
CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).
CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805). -…

Record: SUSE-SU-2026:3130-1
Updated: 2026-11-02

OSVSUSE-SU-2026:3166-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593 bsc#1264419).
CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).
CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805). -…

Record: SUSE-SU-2026:3166-1
Updated: 2026-11-02

OSVUSN-8567-1 No score

linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)