CVE-2026-31681

netfilter: xt_multiport: validate range encoding in checkentry

5.5 MediumFix available

What does this mean?

: 5.5v3.1, from NVD
: 0.12%2nd percentile
Fixed in: 6.6.137.1-1kernel
Published: April 25, 2026
Modified: November 11, 2026
Also known as: AZL-84219BELL-CVE-2026-31681CLSA-2026-1780562693CLSA-2026-1783362244DEBIAN-CVE-2026-31681EUVD-2026-25648GHSA-f822-mpgr-7cqxOESA-2026-2869
Show 45 moreShow less
OESA-2026-3157ROOT-OS-DEBIAN-11-CVE-2026-31681ROOT-OS-DEBIAN-12-CVE-2026-31681ROOT-OS-UBUNTU-2204-CVE-2026-31681ROOT-OS-UBUNTU-2404-CVE-2026-31681SUSE-SU-2026:2068-1SUSE-SU-2026:21834-1SUSE-SU-2026:21841-1SUSE-SU-2026:21845-1SUSE-SU-2026:21860-1SUSE-SU-2026:21876-1SUSE-SU-2026:21877-1SUSE-SU-2026:21916-1SUSE-SU-2026:21919-1SUSE-SU-2026:2217-1SUSE-SU-2026:2238-1UBUNTU-CVE-2026-31681USN-8567-1USN-8574-1USN-8574-2USN-8574-3USN-8575-1USN-8575-2USN-8575-3USN-8576-1USN-8576-2USN-8595-1USN-8595-2USN-8595-3USN-8596-1USN-8597-1USN-8606-1USN-8607-1USN-8608-1USN-8609-1USN-8610-1USN-8619-1USN-8620-1USN-8620-2USN-8620-3USN-8620-4USN-8665-1USN-8668-1USN-8668-2openSUSE-SU-2026:20826-1

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_multiport: validate range encoding in checkentry

ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end.

The checkentry path currently validates protocol, flags and count, but it does not validate the range encoding itself. As a result, malformed rules can mark the last slot as a range start or place two range starts back to back, leaving ports_match_v1() to step past the last valid ports[] element while interpreting the rule.

Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.12%Up 0.1 points since Apr 25, 2026

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_multiport: validate range encoding in checkentry

ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end.

Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.

Record: CVE-2026-31681
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-10

CVE List No score

netfilter: xt_multiport: validate range encoding in checkentry

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_multiport: validate range encoding in checkentry

ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end.

Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.

Record: CVE-2026-31681
Updated: 2026-11-10

EUVDEUVD-2026-25648 No score

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_multiport: validate range encoding in checkentry

ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end.

Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.

Record: EUVD-2026-25648
Updated: 2026-11-10

GitHub AdvisoriesGHSA-f822-mpgr-7cqx 5.5

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_multiport:...

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_multiport: validate range encoding in checkentry

ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end.

Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.

Record: GHSA-f822-mpgr-7cqx
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-31681 5.5

Record: BELL-CVE-2026-31681
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-31681 5.5

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_multiport: validate range encoding in checkentry ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end. The checkentry path currently validates protocol, flags and count, but it does not validate the range encoding itself. As a result, malformed rules can mark the last slot as a range start or place two range starts back to back, leaving ports_match_v1() to step past the last valid ports[] element while interpreting the rule. Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.

Record: DEBIAN-CVE-2026-31681
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

Show 48 moreShow less

OSVOESA-2026-2869 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.(CVE-2025-10263)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)

In smbd_destroy() we may destroy the memory so we better wait until post_send_credits_work is no longer pending and will never be started again.

I actually just hit the case using rxe:

WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe] ... [ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs] [ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs] [ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60 [ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs] [ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs] [ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs] [ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10 [ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0 [ 5305.687889] [ T138] process_one_work+0x629/0xf80 [ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687933] [ T138] worker_thread+0x87f/0x1570 ...

It means rxe_post_recv was called after rdma_destroy_qp(). This happened because put_receive_buffer() was triggered by ib_drain_qp() and called: queue_work(info->workqueue, &info->post_send_credits_work);(CVE-2025-39932)

In the Linux kernel, the following vulnerability has been resolved:

riscv: Sanitize syscall table indexing under speculation

The syscall number is a user-controlled value used to index into the syscall table. Use array_index_nospec() to clamp this value after the bounds check to prevent speculative out-of-bounds access and subsequent data leakage via cache side channels.(CVE-2025-71203)

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: release admin tagset if init fails

nvme_fabrics creates an NVMe/FC controller in following path:

nvmf_dev_write()
  -&gt; nvmf_create_ctrl()
    -&gt; nvme_fc_create_ctrl()
      -&gt; nvme_fc_init_ctrl()

nvme_fc_init_ctrl() allocates the admin blk-mq resources right after nvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing the controller state, scheduling connect work, etc.), we jump to the fail_ctrl path, which tears down the controller references but never frees the admin queue/tag set. The leaked blk-mq allocations match the kmemleak report seen during blktests nvme/fc.

Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call nvme_remove_admin_tag_set() when it is set so that all admin queue allocations are reclaimed whenever controller setup aborts.(CVE-2026-23261)

In the Linux kernel, the following vulnerability has been resolved:

arm64: io: Extract user memory type in ioremap_prot()

The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' value determined from the user mapping of the target 'pfn' being accessed by the kernel. On arm64, the…

Record: OESA-2026-2869
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-3157 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)

In smbd_destroy() we may destroy the memory so we better wait until post_send_credits_work is no longer pending and will never be started again.

I actually just hit the case using rxe:

In the Linux kernel, the following vulnerability has been resolved:

MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits

Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used, and this macro can generate more than 2 instructions. At the same time, the code in ftrace assumes that no more than 2 instructions can be generated, which is why it stores them in an int[2] array. However, as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA) causes a buffer overflow when _mcount is beyond 32 bits. This leads to corruption of the variables located in the __read_mostly section.

This corruption was observed because the variable __cpu_primary_thread_mask was corrupted, causing a hang very early during boot.

This fix prevents the corruption by avoiding the generation of instructions if they could exceed 2 instructions in length. Fortunately, insn_la_mcount is only used if the instrumented code is located outside the kernel code section, so dynamic ftrace can still be used, albeit in a more limited scope. This is still preferable to corrupting memory and/or crashing the kernel.(CVE-2025-71109)

In the Linux kernel, the following vulnerability has been resolved:

riscv: Sanitize syscall table indexing under speculation

In the Linux kernel, the following vulnerability has been resolved: …

Record: OESA-2026-3157
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2026-31681 5.5

CVE-2026-31681 in linux - Patched by Root

Root has patched CVE-2026-31681 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2026-31681
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2026-31681 5.5

CVE-2026-31681 in linux - Patched by Root

Root has patched CVE-2026-31681 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-31681
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-31681 5.5

CVE-2026-31681 in linux - Patched by Root

Root has patched CVE-2026-31681 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-31681
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2026-31681 5.5

CVE-2026-31681 in linux - Patched by Root

Root has patched CVE-2026-31681 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-31681
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-31681 0.0

Record: UBUNTU-CVE-2026-31681
CVSS 4.0: 0.0 NoneCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVAZL-84219 No score

CVE-2026-31681 affecting package kernel for versions less than 6.6.137.1-1

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_multiport: validate range encoding in checkentry

ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end.

Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.

Record: AZL-84219
Updated: 2026-11-02

OSVCLSA-2026-1780562693 No score

kernel: Fix of 111 CVEs

fbcon: Fix OOB access in font allocation {CVE-2025-39967}
fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
macvlan: observe an RCU grace period in macvlan_common_newlink() error path {CVE-2026-23273}
macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
net_sched: sch_sfq: move the limit validation {CVE-2025-37752}
bpf: Fix oob access in cgroup local storage {CVE-2025-38502}
ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT {CVE-2026-43475}
unshare: fix unshare_fs() handling {CVE-2026-43472}
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
e1000/e1000e: Fix leak in DMA error cleanup {CVE-2026-43445}
cgroup: fix race between task migration and iteration {CVE-2026-43439}
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
usb: image: mdc800: kill download URB on timeout {CVE-2026-43425}
tipc: fix divide-by-zero in tipc_sk_filter_connect() {CVE-2026-43411}
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep {CVE-2026-43381}
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() {CVE-2026-43068}
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP {CVE-2026-31424}
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() {CVE-2026-31423}
net/sched: cls_flow: fix NULL pointer dereference on shared blocks {CVE-2026-31422}
net/sched: cls_fw: fix NULL pointer dereference on shared blocks {CVE-2026-31421}
netfilter: ipset: drop logically empty buckets in mtype_del {CVE-2026-31418}
netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
sunrpc: fix cache_request leak in cache_release {CVE-2026-31400}
PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453}
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
RDMA/umem: Fix double dma_buf_unpin in failure path {CVE-2026-43128}
usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454}
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() {CVE-2025-38441}
nvmet: fix memory leak of bio integrity {CVE-2025-38405}
nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. {CVE-2025-38400}
dmaengine: idxd: fix memory leak in error handling path of idxd_alloc {CVE-2025-38015}
bonding: check xdp prog when set bond mode {CVE-2025-22105}
usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD {CVE-2026-31428}
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp {CVE-2026-31427}
ipv6: avoid overflows in ip6_datagram_send_ctl() {CVE-2026-31415}
net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243}
perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344}
x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363}
dm: remove fake timeout to avoid leak request {CVE-2026-43314}
drm: Account property blob allocations to memcg {CVE-2026-43287}
HID:…

Record: CLSA-2026-1780562693
Updated: 2026-11-02

OSVCLSA-2026-1783362244 No score

kernel: Fix of 122 CVEs

KVM: x86: Fix shadow paging use-after-free due to unexpected role {CVE-2026-46113}
KVM: x86: Fix shadow paging use-after-free due to unexpected GFN {CVE-2026-46113}
Bluetooth: bcsp: receive data only if registered {CVE-2025-40308}
xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts {CVE-2026-43429}
net: usb: rtl8150: enable basic endpoint checking {CVE-2025-21708}
net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
net: usb: pegasus: validate USB endpoints {CVE-2026-23290}
net: usb: pegasus: enable basic endpoint checking {CVE-2026-43156}
USB: usbcore: Introduce usb_bulk_msg_killable() {CVE-2026-43429}
USB: core: Add routines for endpoint checks in old drivers {CVE-2026-43156}
nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
tpm: Cap the number of PCR banks {CVE-2025-71077}
clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() {CVE-2023-53704}
dm: fix a race condition in retrieve_deps {CVE-2023-54324}
ice: fix Tx scheduler error handling in XDP callback {CVE-2025-38127}
mlx5: fix skb leak while fifo resync and push {CVE-2023-54238}
mmc: vub300: fix return value check of mmc_add_host() {CVE-2022-50251}
bonding: annotate data-races around slave->last_rx {CVE-2026-23212}
RDMA/irdma: Fix data race on CQP completion stats {CVE-2023-54302}
bpf: cpumap: Fix memory leak in cpu_map_update_elem {CVE-2023-53441}
fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38215}
trace/fgraph: Fix the warning caused by missing unregister notifier {CVE-2025-39829}
vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
team: prevent adding a device which is already a team device lower {CVE-2024-58071}
net: stmmac: move the EST lock to struct stmmac_priv {CVE-2024-38594}
drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too {CVE-2024-50108}
rxrpc: Fix handling of received connection abort {CVE-2024-58053}
bnxt_en: Fix out-of-bound memcpy() during ethtool -w {CVE-2025-37911}
scsi: storvsc: Ratelimit warning logs to prevent VM denial of service {CVE-2025-21690}
net: atlantic: Fix DMA mapping for PTP hwts ring {CVE-2024-26680}
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() {CVE-2024-47713}
drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2) {CVE-2024-49905}
dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
smb: client: validate the whole DACL before rewriting it in cifsacl {CVE-2026-31709}
PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
cachefiles: fix dentry leak in cachefiles_open_file() {CVE-2024-49870}
mm: revert "mm: shmem: fix data-race in shmem_getattr()" {CVE-2024-53136}
memcg: fix soft lockup in the OOM process {CVE-2024-57977}
resource: fix region_intersects() vs add_memory_driver_managed() {CVE-2024-49878}
r8169: add tally counter fields added with RTL8125 {CVE-2024-49973}
svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() {CVE-2024-53215}
ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths {CVE-2026-43066}
wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() {CVE-2025-71273}
net: netlink: af_netlink: Prevent empty skb by adding a check on len. {CVE-2021-47606}
extcon: Modify extcon device to be created after driver data is set {CVE-2022-49308}
tick/nohz: unexport __init-annotated tick_nohz_full_setup() {CVE-2022-49675}
bridge:…

Record: CLSA-2026-1783362244
Updated: 2026-11-02

OSV No score

netfilter: xt_multiport: validate range encoding in checkentry

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_multiport: validate range encoding in checkentry

ports_match_v1() treats any non-zero pflags entry as the start of a port range and unconditionally consumes the next ports[] element as the range end.

Reject malformed multiport v1 rules in checkentry by validating that each range start has a following element and that the following element is not itself marked as another range start.

Record: CVE-2026-31681
Updated: 2026-11-07

OSVopenSUSE-SU-2026:20826-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

Record: openSUSE-SU-2026:20826-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2068-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50053: iavf: Fix reset error handling (bsc#1245038).
CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1. (bsc#1243603).
CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500 bsc#1262778).
CVE-2025-68185: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (bsc#1255135).
CVE-2025-71118: ACPICA: Avoid walking the Namespace if start_node is NULL (bsc#1256763).
CVE-2025-71238: scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1259186).
CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23290: net: usb: pegasus: validate USB endpoints (bsc#1260533).
CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
CVE-2026-23312: net: usb: kaweth: validate USB endpoints (bsc#1260561).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23378: act_ife: load meta modules before tcf_idr_check_alloc() (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-31393: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (bsc#1261719).
CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).
CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).
CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).
CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).
CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).
CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).
CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).
CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).
CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).
CVE-2026-31496: netfilter: nf_conntrack_expect: skip…

Record: SUSE-SU-2026:2068-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21834-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

Record: SUSE-SU-2026:21834-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21841-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

Record: SUSE-SU-2026:21841-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21845-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

Record: SUSE-SU-2026:21845-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21860-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

Record: SUSE-SU-2026:21860-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21876-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
CVE-2026-31407:…

Record: SUSE-SU-2026:21876-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21877-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
CVE-2026-31407:…

Record: SUSE-SU-2026:21877-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21916-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
CVE-2026-31407:…

Record: SUSE-SU-2026:21916-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21919-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
CVE-2026-31407:…

Record: SUSE-SU-2026:21919-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2217-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix…

Record: SUSE-SU-2026:2217-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2238-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323:…

Record: SUSE-SU-2026:2238-1
Updated: 2026-11-02

OSVUSN-8567-1 No score

linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)