CVE-2026-31648

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state":

" [ 734.496287] BUG: Bad page state in process stress-ng-env pfn:415735fb [ 734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb [ 734.496434] flags: 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff) [ 734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000 [ 734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000 [ 734.496442] page dumped because: nonzero mapcount "

After analyzing this page’s state, it is hard to understand why the mapcount is not 0 while the refcount is 0, since this page is not where the issue first occurred. By enabling the CONFIG_DEBUG_VM config, I can reproduce the crash as well and captured the first warning where the issue appears:

" [ 734.469226] page: refcount:33 mapcount:0 mapping:00000000bef2d187 index:0x81a0 pfn:0x415735c0 [ 734.469304] head: order:5 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 734.469315] memcg:ffff000807a8ec00 [ 734.469320] aops:ext4_da_aops ino:100b6f dentry name(?):"stress-ng-mmaptorture-9397-0-2736200540" [ 734.469335] flags: 0x57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x3ffff) ...... [ 734.469364] page dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1), const struct page *: (const struct folio *)_compound_head(page + nr_pages - 1), struct page *: (struct folio *)_compound_head(page + nr_pages - 1))) != folio) [ 734.469390] ------------[ cut here ]------------ [ 734.469393] WARNING: ./include/linux/rmap.h:351 at folio_add_file_rmap_ptes+0x3b8/0x468, CPU#90: stress-ng-mlock/9430 [ 734.469551] folio_add_file_rmap_ptes+0x3b8/0x468 (P) [ 734.469555] set_pte_range+0xd8/0x2f8 [ 734.469566] filemap_map_folio_range+0x190/0x400 [ 734.469579] filemap_map_pages+0x348/0x638 [ 734.469583] do_fault_around+0x140/0x198 ...... [ 734.469640] el0t_64_sync+0x184/0x188 "

The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size.

By adding more debug information, I found that 'nr_pages' had overflowed in filemap_map_pages(), causing set_pte_range() to establish mappings for a range exceeding the folio size, potentially corrupting fields of pages that do not belong to this folio (e.g., page->_mapcount).

After above analysis, I think the possible race is as follows:

CPU 0 CPU 1 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio()

                                                      .......
                                                      //shrink the inode->i_size
                                                      i_size_write(inode, attr->ia_size);

//calculate the end_pgoff with the new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end);

...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1;

...... //map large folio filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size);

To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid ---truncated---

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.12%Up 0.1 points since Apr 25, 2026

What each source reports

CVE List Score used 7.8

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state":

The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size.

After above analysis, I think the possible race is as follows:

CPU 0 CPU 1 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio()

                                                      .......
                                                      //shrink the inode->i_size
                                                      i_size_write(inode, attr->ia_size);

//calculate the end_pgoff with the new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end);

...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1;

...... //map large folio filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size);

To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid ---truncated---

Record: CVE-2026-31648
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

EUVDEUVD-2026-25541 7.8

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state":

The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size.

After above analysis, I think the possible race is as follows:

CPU 0 CPU 1 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio()

                                                      .......
                                                      //shrink the inode->i_size
                                                      i_size_write(inode, attr->ia_size);

//calculate the end_pgoff with the new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end);

...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1;

...... //map large folio filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size);

To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid ---truncated---

Record: EUVD-2026-25541
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5fqc-9jpf-8wjm 7.8

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: fix nr_pages...

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state":

The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size.

After above analysis, I think the possible race is as follows:

CPU 0 CPU 1 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio()

                                                      .......
                                                      //shrink the inode->i_size
                                                      i_size_write(inode, attr->ia_size);

//calculate the end_pgoff with the new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end);

...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1;

...... //map large folio filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size);

To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid ---truncated---

Record: GHSA-5fqc-9jpf-8wjm
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state":

The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size.

After above analysis, I think the possible race is as follows:

CPU 0 CPU 1 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio()

                                                      .......
                                                      //shrink the inode->i_size
                                                      i_size_write(inode, attr->ia_size);

//calculate the end_pgoff with the new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end);

...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1;

...... //map large folio filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size);

To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid ---truncated---

Record: CVE-2026-31648
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSVBELL-CVE-2026-31648 7.8

Record: BELL-CVE-2026-31648
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state":

The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size.

After above analysis, I think the possible race is as follows:

CPU 0 CPU 1 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio()

                                                      .......
                                                      //shrink the inode->i_size
                                                      i_size_write(inode, attr->ia_size);

//calculate the end_pgoff with the new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end);

...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1;

...... //map large folio filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size);

To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid ---truncated---

Record: CVE-2026-31648
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 26 moreShow less

OSVDEBIAN-CVE-2026-31648 7.8

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state": " [ 734.496287] BUG: Bad page state in process stress-ng-env pfn:415735fb [ 734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb [ 734.496434] flags: 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff) [ 734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000 [ 734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000 [ 734.496442] page dumped because: nonzero mapcount " After analyzing this page’s state, it is hard to understand why the mapcount is not 0 while the refcount is 0, since this page is not where the issue first occurred. By enabling the CONFIG_DEBUG_VM config, I can reproduce the crash as well and captured the first warning where the issue appears: " [ 734.469226] page: refcount:33 mapcount:0 mapping:00000000bef2d187 index:0x81a0 pfn:0x415735c0 [ 734.469304] head: order:5 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 734.469315] memcg:ffff000807a8ec00 [ 734.469320] aops:ext4_da_aops ino:100b6f dentry name(?):"stress-ng-mmaptorture-9397-0-2736200540" [ 734.469335] flags: 0x57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x3ffff) ...... [ 734.469364] page dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1), const struct page *: (const struct folio *)_compound_head(page + nr_pages - 1), struct page *: (struct folio *)_compound_head(page + nr_pages - 1))) != folio) [ 734.469390] ------------[ cut here ]------------ [ 734.469393] WARNING: ./include/linux/rmap.h:351 at folio_add_file_rmap_ptes+0x3b8/0x468, CPU#90: stress-ng-mlock/9430 [ 734.469551] folio_add_file_rmap_ptes+0x3b8/0x468 (P) [ 734.469555] set_pte_range+0xd8/0x2f8 [ 734.469566] filemap_map_folio_range+0x190/0x400 [ 734.469579] filemap_map_pages+0x348/0x638 [ 734.469583] do_fault_around+0x140/0x198 ...... [ 734.469640] el0t_64_sync+0x184/0x188 " The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size. By adding more debug information, I found that 'nr_pages' had overflowed in filemap_map_pages(), causing set_pte_range() to establish mappings for a range exceeding the folio size, potentially corrupting fields of pages that do not belong to this folio (e.g., page->_mapcount). After above analysis, I think the possible race is as follows: CPU 0 CPU 1 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio() ....... //shrink the inode->i_size i_size_write(inode, attr->ia_size); //calculate the end_pgoff with the new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end); ...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1; ...... //map large folio filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size); To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid ---truncated---

Record: DEBIAN-CVE-2026-31648
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2026-31648 5.5

CVE-2026-31648 in linux - Patched by Root

Root has patched CVE-2026-31648 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-31648
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2026-31648 5.5

CVE-2026-31648 in linux - Patched by Root

Root has patched CVE-2026-31648 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-31648
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-31648 7.3

Record: UBUNTU-CVE-2026-31648
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-11

OSVAZL-84581 No score

CVE-2026-31648 affecting package kernel for versions less than 6.6.137.1-1

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I encountered some very strange crash issues showing up as "Bad page state":

The code that triggers the warning is: "VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)", which indicates that set_pte_range() tried to map beyond the large folio’s size.

After above analysis, I think the possible race is as follows:

CPU 0 CPU 1 filemap_map_pages() ext4_setattr() //get and lock folio with old inode->i_size next_uptodate_folio()

                                                      .......
                                                      //shrink the inode->i_size
                                                      i_size_write(inode, attr->ia_size);

//calculate the end_pgoff with the new inode->i_size file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end);

...... //nr_pages can be overflowed, cause xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1;

...... //map large folio filemap_map_folio_range() ...... //truncate folios truncate_pagecache(inode, inode->i_size);

To fix this issue, move the 'end_pgoff' calculation before next_uptodate_folio(), so the retrieved folio stays consistent with the file end to avoid ---truncated---

Record: AZL-84581
Updated: 2026-11-02

OSVMGASA-2026-0108 No score

Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.137 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Record: MGASA-2026-0108
Updated: 2026-11-02

OSVMGASA-2026-0110 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.137 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0110
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20965-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

Record: openSUSE-SU-2026:20965-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22099-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

Record: SUSE-SU-2026:22099-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22112-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

Record: SUSE-SU-2026:22112-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22117-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

Record: SUSE-SU-2026:22117-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22127-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

Record: SUSE-SU-2026:22127-1
Updated: 2026-11-02

OSVUSN-8567-1 No score

linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)