CVE-2026-31596

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

fbdev: fix potential buffer overflow in do_register_framebuffer()

The current implementation may lead to buffer overflow when:

1. Unregistration creates NULL gaps in registered_fb[]
2. All array slots become occupied despite num_registered_fb < FB_MAX
3. The registration loop exceeds array bounds

Add boundary check to prevent registered_fb[FB_MAX] access.(CVE-2025-38702)

In the Linux kernel, the following vulnerability has been resolved:

hfs: validate record offset in hfsplus_bmap_alloc

hfsplus_bmap_alloc can trigger a crash if a record offset or length is larger than node_size

[ 15.264282] BUG: KASAN: slab-out-of-bounds in hfsplus_bmap_alloc+0x887/0x8b0 [ 15.265192] Read of size 8 at addr ffff8881085ca188 by task test/183 [ 15.265949] [ 15.266163] CPU: 0 UID: 0 PID: 183 Comm: test Not tainted 6.17.0-rc2-gc17b750b3ad9 #14 PREEMPT(voluntary) [ 15.266165] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.266167] Call Trace: [ 15.266168] <TASK> [ 15.266169] dump_stack_lvl+0x53/0x70 [ 15.266173] print_report+0xd0/0x660 [ 15.266181] kasan_report+0xce/0x100 [ 15.266185] hfsplus_bmap_alloc+0x887/0x8b0 [ 15.266208] hfs_btree_inc_height.isra.0+0xd5/0x7c0 [ 15.266217] hfsplus_brec_insert+0x870/0xb00 [ 15.266222] __hfsplus_ext_write_extent+0x428/0x570 [ 15.266225] __hfsplus_ext_cache_extent+0x5e/0x910 [ 15.266227] hfsplus_ext_read_extent+0x1b2/0x200 [ 15.266233] hfsplus_file_extend+0x5a7/0x1000 [ 15.266237] hfsplus_get_block+0x12b/0x8c0 [ 15.266238] __block_write_begin_int+0x36b/0x12c0 [ 15.266251] block_write_begin+0x77/0x110 [ 15.266252] cont_write_begin+0x428/0x720 [ 15.266259] hfsplus_write_begin+0x51/0x100 [ 15.266262] cont_write_begin+0x272/0x720 [ 15.266270] hfsplus_write_begin+0x51/0x100 [ 15.266274] generic_perform_write+0x321/0x750 [ 15.266285] generic_file_write_iter+0xc3/0x310 [ 15.266289] __kernel_write_iter+0x2fd/0x800 [ 15.266296] dump_user_range+0x2ea/0x910 [ 15.266301] elf_core_dump+0x2a94/0x2ed0 [ 15.266320] vfs_coredump+0x1d85/0x45e0 [ 15.266349] get_signal+0x12e3/0x1990 [ 15.266357] arch_do_signal_or_restart+0x89/0x580 [ 15.266362] irqentry_exit_to_user_mode+0xab/0x110 [ 15.266364] asm_exc_page_fault+0x26/0x30 [ 15.266366] RIP: 0033:0x41bd35 [ 15.266367] Code: bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 9f 0b 00 00 66 0f ef c0 <f3> 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d0 49 83 f8f [ 15.266369] RSP: 002b:00007ffc9e62d078 EFLAGS: 00010283 [ 15.266371] RAX: 00007ffc9e62d100 RBX: 0000000000000000 RCX: 0000000000000000 [ 15.266372] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffc9e62d100 [ 15.266373] RBP: 0000400000000040 R08: 00000000000000e0 R09: 0000000000000000 [ 15.266374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 15.266375] R13: 0000000000000000 R14: 0000000000000000 R15: 0000400000000000 [ 15.266376] </TASK>

When calling hfsplus_bmap_alloc to allocate a free node, this function first retrieves the bitmap from header node and map node using node->page together with the offset and length from hfs_brec_lenoff

len = hfs_brec_lenoff(node, 2, &off16);
off = off16;

off += node->page_offset;
pagep = node->page + (off >> PAGE_SHIFT);
data = kmap_local_page(*pagep);

However, if the retrieved offset or length is invalid(i.e. exceeds node_size), the code may end up accessing pages outside the allocated range for this node.

This patch adds proper validation of both offset and length before use, preventing out-of-bounds page access. Move is_bnode_offset_valid and check_and_correct_requested_length to hfsplus_fs.h, as they may be required by other…

Root has patched CVE-2026-31596 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-31596 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-31596 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-31596 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: ocfs2: handle invalid dinode in ocfs2_group_extend [BUG] kernel BUG at fs/ocfs2/resize.c:308! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308 Code: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe Call Trace: ... ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... [CAUSE] ocfs2_group_extend() assumes that the global bitmap inode block returned from ocfs2_inode_lock() has already been validated and BUG_ONs when the signature is not a dinode. That assumption is too strong for crafted filesystems because the JBD2-managed buffer path can bypass structural validation and return an invalid dinode to the resize ioctl. [FIX] Validate the dinode explicitly in ocfs2_group_extend(). If the global bitmap buffer does not contain a valid dinode, report filesystem corruption with ocfs2_error() and fail the resize operation instead of crashing the kernel.

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: handle invalid dinode in ocfs2_group_extend

[BUG] kernel BUG at fs/ocfs2/resize.c:308! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308 Code: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe Call Trace: ... ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e ...

[CAUSE] ocfs2_group_extend() assumes that the global bitmap inode block returned from ocfs2_inode_lock() has already been validated and BUG_ONs when the signature is not a dinode. That assumption is too strong for crafted filesystems because the JBD2-managed buffer path can bypass structural validation and return an invalid dinode to the resize ioctl.

[FIX] Validate the dinode explicitly in ocfs2_group_extend(). If the global bitmap buffer does not contain a valid dinode, report filesystem corruption with ocfs2_error() and fail the resize operation instead of crashing the kernel.

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: handle invalid dinode in ocfs2_group_extend

[BUG] kernel BUG at fs/ocfs2/resize.c:308! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308 Code: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe Call Trace: ... ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e ...

[CAUSE] ocfs2_group_extend() assumes that the global bitmap inode block returned from ocfs2_inode_lock() has already been validated and BUG_ONs when the signature is not a dinode. That assumption is too strong for crafted filesystems because the JBD2-managed buffer path can bypass structural validation and return an invalid dinode to the resize ioctl.

[FIX] Validate the dinode explicitly in ocfs2_group_extend(). If the global bitmap buffer does not contain a valid dinode, report filesystem corruption with ocfs2_error() and fail the resize operation instead of crashing the kernel.

These are all security issues fixed in the kernel-devel-7.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
• CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
• CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43035: net:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero (bsc#1264091).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
• CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero (bsc#1264091).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
• CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
• CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
• CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
• CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
• CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43035: net:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
• CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
• CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43035: net:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
• CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
• CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43035: net:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
• CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
• CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43035: net:…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: Add workaround for Cortex-A76 erratum 1286807 (bsc#1266290).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23279: wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (bsc#1260468).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23367: wifi: radiotap: reject radiotap with unknown bits (bsc#1260731).
• CVE-2026-23396: wifi: mac80211: fix NULL deref in mesh_matches_local() (bsc#1260729).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-23448: net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (bsc#1261750).
• CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
• CVE-2026-31415: ipv6: avoid overflows in ip6_datagram_send_ctl() (bsc#1262099).
• CVE-2026-31421: net/sched: cls_fw: fix NULL pointer dereference on shared blocks (bsc#1262061).
• CVE-2026-31447: ext4: reject mount if bigalloc with s_first_data_block != 0 (bsc#1262614).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31498: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (bsc#1262751).
• CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
• CVE-2026-31515: af_key: validate families in pfkey_send_migrate() (bsc#1262752).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31532: can: af_can: export can_sock_destruct() (bsc#1262757).
• CVE-2026-31540: drm/i915/gt: Check set_default_submission() before deferencing (bsc#1263011).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
• CVE-2026-31668: seg6: separate dst_cache for input and output paths in seg6 lwtunnel (bsc#1263140).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
• CVE-2026-31778: ALSA: caiaq: fix stack out-of-bounds read in init_card (bsc#1263923).
• CVE-2026-43020: Bluetooth: MGMT: validate LTK enc_size on load (bsc#1264006).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb in…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31591: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (bsc#1263122).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info- leak (bsc#1264091).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
• CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31591: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (bsc#1263122).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info- leak (bsc#1264091).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
• CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Character device driver;
• TPM device driver;
• Hardware crypto device drivers;
• EDAC drivers;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• IBM Advanced System Management driver;
• MTD block device drivers;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• NTB driver;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• Thermal drivers;
• USB Gadget drivers;
• USB over IP driver;
• VFIO drivers;
• Framebuffer layer;
• 9P distributed file system;
• AFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• Journaling layer for block devices (JBD2);
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• UDF file system;
• XFS file system;
• Codetag library;
• Memory management;
• Memory Management;
• KVM subsystem;
• Tracing infrastructure;
• User-space API (UAPI);
• io_uring subsystem;
• Locking primitives;
• Timer subsystem;
• Scatterlist API;
• Heterogeneous memory management;
• KASAN memory debugging framework;
• Bluetooth subsystem;
• Ethernet bridge;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Packet sockets;
• Qualcomm IPC Router (QRTR);
• RDS protocol;
• RxRPC session sockets;
• SMC sockets;
• Stream parser;
• Landlock security;
• SELinux security module;
• ALSA framework;
• Generic PCM loopback sound driver;
• FireWire sound drivers;
• Creative Sound Blaster X-Fi driver;
• QCOM ASoC drivers;
• USB sound devices;
• Objtool; (CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31579, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31589, CVE-2026-31590, CVE-2026-31591, CVE-2026-31592, CVE-2026-31593, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600, CVE-2026-31601, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607, CVE-2026-31608, CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31614, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31620, CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31686, CVE-2026-31694, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31703, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31710, CVE-2026-31711,…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Character device driver;
• TPM device driver;
• Hardware crypto device drivers;
• EDAC drivers;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• IBM Advanced System Management driver;
• MTD block device drivers;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• NTB driver;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• Thermal drivers;
• USB Gadget drivers;
• USB over IP driver;
• VFIO drivers;
• Framebuffer layer;
• 9P distributed file system;
• AFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• Journaling layer for block devices (JBD2);
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• UDF file system;
• XFS file system;
• Codetag library;
• Memory management;
• Memory Management;
• KVM subsystem;
• Tracing infrastructure;
• User-space API (UAPI);
• io_uring subsystem;
• Locking primitives;
• Timer subsystem;
• Scatterlist API;
• Heterogeneous memory management;
• KASAN memory debugging framework;
• Bluetooth subsystem;
• Ethernet bridge;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Packet sockets;
• Qualcomm IPC Router (QRTR);
• RDS protocol;
• RxRPC session sockets;
• SMC sockets;
• Stream parser;
• Landlock security;
• SELinux security module;
• ALSA framework;
• Generic PCM loopback sound driver;
• FireWire sound drivers;
• Creative Sound Blaster X-Fi driver;
• QCOM ASoC drivers;
• USB sound devices;
• Objtool; (CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31579, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31589, CVE-2026-31590, CVE-2026-31591, CVE-2026-31592, CVE-2026-31593, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600, CVE-2026-31601, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607, CVE-2026-31608, CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31614, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31620, CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31686, CVE-2026-31694, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31703, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31710, CVE-2026-31711,…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Character device driver;
• TPM device driver;
• Hardware crypto device drivers;
• EDAC drivers;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• IBM Advanced System Management driver;
• MTD block device drivers;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• NTB driver;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Remote Processor subsystem;
• SCSI subsystem;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• Thermal drivers;
• USB Gadget drivers;
• USB over IP driver;
• VFIO drivers;
• Framebuffer layer;
• 9P distributed file system;
• AFS file system;
• Ceph distributed file system;
• File systems infrastructure;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• Journaling layer for block devices (JBD2);
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• SMB network file system;
• UDF file system;
• XFS file system;
• Codetag library;
• Memory management;
• Memory Management;
• KVM subsystem;
• Tracing infrastructure;
• User-space API (UAPI);
• io_uring subsystem;
• Locking primitives;
• Timer subsystem;
• Scatterlist API;
• Heterogeneous memory management;
• KASAN memory debugging framework;
• Bluetooth subsystem;
• Ethernet bridge;
• CAIF protocol;
• CAN network layer;
• Ceph Core library;
• IPv4 networking;
• IPv6 networking;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• Packet sockets;
• Qualcomm IPC Router (QRTR);
• RDS protocol;
• RxRPC session sockets;
• SMC sockets;
• Stream parser;
• Landlock security;
• SELinux security module;
• ALSA framework;
• Generic PCM loopback sound driver;
• FireWire sound drivers;
• Creative Sound Blaster X-Fi driver;
• QCOM ASoC drivers;
• USB sound devices;
• Objtool; (CVE-2026-31532, CVE-2026-31574, CVE-2026-31575, CVE-2026-31576, CVE-2026-31577, CVE-2026-31578, CVE-2026-31579, CVE-2026-31580, CVE-2026-31581, CVE-2026-31582, CVE-2026-31583, CVE-2026-31584, CVE-2026-31585, CVE-2026-31586, CVE-2026-31587, CVE-2026-31588, CVE-2026-31589, CVE-2026-31590, CVE-2026-31591, CVE-2026-31592, CVE-2026-31593, CVE-2026-31594, CVE-2026-31595, CVE-2026-31596, CVE-2026-31597, CVE-2026-31598, CVE-2026-31599, CVE-2026-31600, CVE-2026-31601, CVE-2026-31602, CVE-2026-31603, CVE-2026-31604, CVE-2026-31605, CVE-2026-31606, CVE-2026-31607, CVE-2026-31608, CVE-2026-31609, CVE-2026-31610, CVE-2026-31611, CVE-2026-31612, CVE-2026-31613, CVE-2026-31614, CVE-2026-31615, CVE-2026-31616, CVE-2026-31617, CVE-2026-31618, CVE-2026-31619, CVE-2026-31620, CVE-2026-31621, CVE-2026-31622, CVE-2026-31623, CVE-2026-31624, CVE-2026-31625, CVE-2026-31626, CVE-2026-31627, CVE-2026-31628, CVE-2026-31629, CVE-2026-31686, CVE-2026-31694, CVE-2026-31696, CVE-2026-31697, CVE-2026-31698, CVE-2026-31699, CVE-2026-31700, CVE-2026-31701, CVE-2026-31702, CVE-2026-31703, CVE-2026-31704, CVE-2026-31705, CVE-2026-31706, CVE-2026-31707, CVE-2026-31708, CVE-2026-31709, CVE-2026-31710, CVE-2026-31711,…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334)

Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local attacker could use this to cause a kernel oops. (CVE-2026-47337)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PSP security protocol;
• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Intel…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Framebuffer layer;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• SMB network file system;
• SquashFS file system;
• XFS file system;
• Audit subsystem;
• RAS (Reliability, Availability, Serviceability) subsystem;
• CPU frequency scaling framework;
• Memory Management;
• KVM subsystem;
• Memory management;
• Network traffic control;
• Netfilter;
• IP tunnels definitions;
• Tracing infrastructure;
• User-space API (UAPI);
• io_uring subsystem;
• BPF subsystem;
• Control group (cgroup);
• Kernel fork() syscall;
• Kernel futex primitives;
• Kernel kexec() syscall;
• Kernel module support;
• Scheduler…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• PSP security protocol;
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Intel NPU Driver;
• Compute Acceleration Framework;
• ACPI drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• IBM Advanced System Management driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• Device tree and open firmware driver;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• Power supply drivers;
• Remote Processor subsystem;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• S/390 drivers;
• SCSI subsystem;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• TI TPS6598x USB Power Delivery controller driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Framebuffer layer;
• TSM AMD SEV Guest driver;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• HugeTLB file system;
• Journaling layer for block devices (JBD2);
• Network file systems…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• RNBD block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• MediaTek SoC drivers;
• Microchip PolarFire SoC system controller driver;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• RNBD block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• MediaTek SoC drivers;
• Microchip PolarFire SoC system controller driver;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• RNBD block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• MediaTek SoC drivers;
• Microchip PolarFire SoC system controller driver;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• RNBD block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• MediaTek SoC drivers;
• Microchip PolarFire SoC system controller driver;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…