CVE-2026-43015

net: macb: fix clk handling on PCI glue driver removal

7.8 HighFix available

What does this mean?

: 7.8v3.1, from NVD
: 0.13%2nd percentile
Fixed in: 6.1.168-r0linux-lts
Published: May 1, 2026
Modified: November 11, 2026
Weakness: CWE-416
Also known as: BELL-CVE-2026-43015CLSA-2026-1789958474CLSA-2026-1792981530CLSA-2026-1792983235DEBIAN-CVE-2026-43015EUVD-2026-26614GHSA-x83c-972p-8775MGASA-2026-0108
Show 38 moreShow less
MGASA-2026-0110ROOT-OS-DEBIAN-11-CVE-2026-43015ROOT-OS-UBUNTU-2204-CVE-2026-43015ROOT-OS-UBUNTU-2404-CVE-2026-43015SUSE-SU-2026:22742-1SUSE-SU-2026:22769-1SUSE-SU-2026:22812-1SUSE-SU-2026:22835-1SUSE-SU-2026:4120-1SUSE-SU-2026:4254-1UBUNTU-CVE-2026-43015USN-8567-1USN-8574-1USN-8574-2USN-8574-3USN-8575-1USN-8575-2USN-8575-3USN-8576-1USN-8576-2USN-8595-1USN-8595-2USN-8595-3USN-8596-1USN-8606-1USN-8607-1USN-8608-1USN-8609-1USN-8610-1USN-8619-1USN-8620-1USN-8620-2USN-8620-3USN-8620-4USN-8665-1USN-8668-1USN-8668-2openSUSE-SU-2026:21388-1

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix clk handling on PCI glue driver removal

platform_device_unregister() may still want to use the registered clks during runtime resume callback.

Note that there is a commit d82d5303c4c5 ("net: macb: fix use after free on rmmod") that addressed the similar problem of clk vs platform device unregistration but just moved the bug to another place.

Save the pointers to clks into local variables for reuse after platform device is unregistered.

BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 Read of size 8 at addr ffff888104f85e00 by task modprobe/597

CPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x8d/0xba print_report+0x17f/0x496 kasan_report+0xd9/0x180 clk_prepare+0x5a/0x60 macb_runtime_resume+0x13d/0x410 [macb] pm_generic_runtime_resume+0x97/0xd0 __rpm_callback+0xc8/0x4d0 rpm_callback+0xf6/0x230 rpm_resume+0xeeb/0x1a70 __pm_runtime_resume+0xb4/0x170 bus_remove_device+0x2e3/0x4b0 device_del+0x5b3/0xdc0 platform_device_del+0x4e/0x280 platform_device_unregister+0x11/0x50 pci_device_remove+0xae/0x210 device_remove+0xcb/0x180 device_release_driver_internal+0x529/0x770 driver_detach+0xd4/0x1a0 bus_remove_driver+0x135/0x260 driver_unregister+0x72/0xb0 pci_unregister_driver+0x26/0x220 __do_sys_delete_module+0x32e/0x550 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 </TASK>

Allocated by task 519: kasan_save_stack+0x2c/0x50 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x8e/0x90 __clk_register+0x458/0x2890 clk_hw_register+0x1a/0x60 __clk_hw_register_fixed_rate+0x255/0x410 clk_register_fixed_rate+0x3c/0xa0 macb_probe+0x1d8/0x42e [macb_pci] local_pci_probe+0xd7/0x190 pci_device_probe+0x252/0x600 really_probe+0x255/0x7f0 __driver_probe_device+0x1ee/0x330 driver_probe_device+0x4c/0x1f0 __driver_attach+0x1df/0x4e0 bus_for_each_dev+0x15d/0x1f0 bus_add_driver+0x486/0x5e0 driver_register+0x23a/0x3d0 do_one_initcall+0xfd/0x4d0 do_init_module+0x18b/0x5a0 load_module+0x5663/0x7950 __do_sys_finit_module+0x101/0x180 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Freed by task 597: kasan_save_stack+0x2c/0x50 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0x106/0x180 __kmem_cache_free+0xbc/0x320 clk_unregister+0x6de/0x8d0 macb_remove+0x73/0xc0 [macb_pci] pci_device_remove+0xae/0x210 device_remove+0xcb/0x180 device_release_driver_internal+0x529/0x770 driver_detach+0xd4/0x1a0 bus_remove_driver+0x135/0x260 driver_unregister+0x72/0xb0 pci_unregister_driver+0x26/0x220 __do_sys_delete_module+0x32e/0x550 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.13%Up 0.1 points since May 2, 2026

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix clk handling on PCI glue driver removal

platform_device_unregister() may still want to use the registered clks during runtime resume callback.

Save the pointers to clks into local variables for reuse after platform device is unregistered.

BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 Read of size 8 at addr ffff888104f85e00 by task modprobe/597

Record: CVE-2026-43015
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

net: macb: fix clk handling on PCI glue driver removal

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix clk handling on PCI glue driver removal

platform_device_unregister() may still want to use the registered clks during runtime resume callback.

Save the pointers to clks into local variables for reuse after platform device is unregistered.

BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 Read of size 8 at addr ffff888104f85e00 by task modprobe/597

Record: CVE-2026-43015
Updated: 2026-11-02

EUVDEUVD-2026-26614 No score

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix clk handling on PCI glue driver removal

platform_device_unregister() may still want to use the registered clks during runtime resume callback.

Save the pointers to clks into local variables for reuse after platform device is unregistered.

BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 Read of size 8 at addr ffff888104f85e00 by task modprobe/597

Record: EUVD-2026-26614
Updated: 2026-11-02

GitHub AdvisoriesGHSA-x83c-972p-8775 7.8

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix clk handling...

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix clk handling on PCI glue driver removal

platform_device_unregister() may still want to use the registered clks during runtime resume callback.

Save the pointers to clks into local variables for reuse after platform device is unregistered.

BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 Read of size 8 at addr ffff888104f85e00 by task modprobe/597

Record: GHSA-x83c-972p-8775
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2026-43015 7.8

Record: BELL-CVE-2026-43015
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-43015 7.8

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix clk handling on PCI glue driver removal platform_device_unregister() may still want to use the registered clks during runtime resume callback. Note that there is a commit d82d5303c4c5 ("net: macb: fix use after free on rmmod") that addressed the similar problem of clk vs platform device unregistration but just moved the bug to another place. Save the pointers to clks into local variables for reuse after platform device is unregistered. BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 Read of size 8 at addr ffff888104f85e00 by task modprobe/597 CPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x8d/0xba print_report+0x17f/0x496 kasan_report+0xd9/0x180 clk_prepare+0x5a/0x60 macb_runtime_resume+0x13d/0x410 [macb] pm_generic_runtime_resume+0x97/0xd0 __rpm_callback+0xc8/0x4d0 rpm_callback+0xf6/0x230 rpm_resume+0xeeb/0x1a70 __pm_runtime_resume+0xb4/0x170 bus_remove_device+0x2e3/0x4b0 device_del+0x5b3/0xdc0 platform_device_del+0x4e/0x280 platform_device_unregister+0x11/0x50 pci_device_remove+0xae/0x210 device_remove+0xcb/0x180 device_release_driver_internal+0x529/0x770 driver_detach+0xd4/0x1a0 bus_remove_driver+0x135/0x260 driver_unregister+0x72/0xb0 pci_unregister_driver+0x26/0x220 __do_sys_delete_module+0x32e/0x550 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 </TASK> Allocated by task 519: kasan_save_stack+0x2c/0x50 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x8e/0x90 __clk_register+0x458/0x2890 clk_hw_register+0x1a/0x60 __clk_hw_register_fixed_rate+0x255/0x410 clk_register_fixed_rate+0x3c/0xa0 macb_probe+0x1d8/0x42e [macb_pci] local_pci_probe+0xd7/0x190 pci_device_probe+0x252/0x600 really_probe+0x255/0x7f0 __driver_probe_device+0x1ee/0x330 driver_probe_device+0x4c/0x1f0 __driver_attach+0x1df/0x4e0 bus_for_each_dev+0x15d/0x1f0 bus_add_driver+0x486/0x5e0 driver_register+0x23a/0x3d0 do_one_initcall+0xfd/0x4d0 do_init_module+0x18b/0x5a0 load_module+0x5663/0x7950 __do_sys_finit_module+0x101/0x180 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 597: kasan_save_stack+0x2c/0x50 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0x106/0x180 __kmem_cache_free+0xbc/0x320 clk_unregister+0x6de/0x8d0 macb_remove+0x73/0xc0 [macb_pci] pci_device_remove+0xae/0x210 device_remove+0xcb/0x180 device_release_driver_internal+0x529/0x770 driver_detach+0xd4/0x1a0 bus_remove_driver+0x135/0x260 driver_unregister+0x72/0xb0 pci_unregister_driver+0x26/0x220 __do_sys_delete_module+0x32e/0x550 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Record: DEBIAN-CVE-2026-43015
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 43 moreShow less

OSVROOT-OS-DEBIAN-11-CVE-2026-43015 7.8

CVE-2026-43015 in linux - Patched by Root

Root has patched CVE-2026-43015 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2026-43015
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-43015 7.8

CVE-2026-43015 in linux - Patched by Root

Root has patched CVE-2026-43015 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-43015
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2026-43015 7.8

CVE-2026-43015 in linux - Patched by Root

Root has patched CVE-2026-43015 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-43015
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-43015 7.8

Record: UBUNTU-CVE-2026-43015
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-11

OSVCLSA-2026-1789958474 No score

Fix of 167 CVEs

CVE-2025-39826
- net: rose: convert 'use' field to refcount_t {CVE-2025-39826}
CVE-2025-40146
- blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
CVE-2024-53216
- nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
CVE-2026-89778
- isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
CVE-2026-23050
- pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
CVE-2025-68796
- f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796}
CVE-2025-68330
- iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
CVE-2025-40333
- f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
CVE-2025-40160
- xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
CVE-2023-54047
- drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
CVE-2025-68190
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
CVE-2025-68188
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
CVE-2026-89786
- ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
CVE-2022-50764
- ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
CVE-2026-80785
- fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
CVE-2026-80788
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788}
CVE-2026-80747
- drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}
CVE-2026-80907
- drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
CVE-2026-80908
- drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
CVE-2026-80812
- ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
CVE-2026-80948
- wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
CVE-2025-40137
- f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
CVE-2023-54150
- drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
CVE-2026-89784
- SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
CVE-2026-89783
- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
CVE-2026-89780
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780}
CVE-2026-89777
- vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777}
CVE-2026-89789
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
CVE-2025-68797
- char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
CVE-2025-68767
- hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
CVE-2026-63961
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961}
CVE-2026-63904
- usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
CVE-2022-50864
- nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
CVE-2025-68771
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
CVE-2025-68750
- usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
CVE-2026-80909
- drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909}
CVE-2026-74402
- crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} *…

Record: CLSA-2026-1789958474
Updated: 2026-11-02

OSVCLSA-2026-1792981530 No score

Fix of 55 CVEs

CVE-2026-98706
- wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
CVE-2026-98836
- ALSA: line6: reject oversized playback packets {CVE-2026-98836}
CVE-2026-98548
- sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
CVE-2026-98614
- sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
CVE-2026-98610
- net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
CVE-2026-98524
- rds: ib: Clear the sg list when mapping an MR fails {CVE-2026-98524}
CVE-2026-98547
- af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
CVE-2026-98850
- net/packet: prevent TX_RING byte count overflow {CVE-2026-98850}
CVE-2026-98577
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
CVE-2026-98482
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
CVE-2026-98576
- nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
CVE-2026-98624
- netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
CVE-2026-98794
- ipvs: filter some flags received in the backup server {CVE-2026-98794}
CVE-2026-98698
- wifi: mac80211: handle empty FILS association request payload {CVE-2026-98698}
CVE-2026-98526
- llc: reserve device headroom for allocated frames {CVE-2026-98526}
CVE-2026-98532
- ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
CVE-2026-98569
- ip_gre: Reject enabling collect metadata through changelink {CVE-2026-98569}
CVE-2026-98541
- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
CVE-2026-98573
- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
CVE-2026-98567
- net: xps: reject an out of range traffic class {CVE-2026-98567}
CVE-2026-98457
- Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
CVE-2026-98460
- Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
CVE-2026-98636
- squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
CVE-2026-98772
- USB: serial: fix port tear down use-after-free {CVE-2026-98772}
CVE-2026-98697
- USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
CVE-2026-98769
- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
CVE-2026-98764
- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764}
CVE-2026-98838
- vt: skip screen update for DEC alignment test on backgroup consoles {CVE-2026-98838}
CVE-2026-98578
- nfc: st21nfca: validate ISO15693 inventory length {CVE-2026-98578}
CVE-2026-98583
- nfc: nfcmrvl: validate helper command length before pull {CVE-2026-98583}
CVE-2026-98612
- net: usb: catc: bound the RX packet length in catc_rx_done() {CVE-2026-98612}
CVE-2026-98722
- mtd: block2mtd: Fix divide error when erase_size is zero {CVE-2026-98722}
CVE-2026-98657
- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure {CVE-2026-98657}
CVE-2026-98623
- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update {CVE-2026-98623}
CVE-2026-98732
- Bluetooth: btintel: fix buffer over-read in btintel_hw_error() {CVE-2026-98732}
CVE-2026-98393
- net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393}
CVE-2026-53255
- Bluetooth:…

Record: CLSA-2026-1792981530
Updated: 2026-11-02

OSVCLSA-2026-1792983235 No score

Fix of 56 CVEs

CVE-2026-98706
- wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
CVE-2026-98836
- ALSA: line6: reject oversized playback packets {CVE-2026-98836}
CVE-2026-98548
- sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
CVE-2026-98614
- sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
CVE-2026-98610
- net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
CVE-2026-98524
- rds: ib: Clear the sg list when mapping an MR fails {CVE-2026-98524}
CVE-2026-98547
- af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
CVE-2026-98850
- net/packet: prevent TX_RING byte count overflow {CVE-2026-98850}
CVE-2026-98577
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
CVE-2026-98482
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
CVE-2026-98576
- nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
CVE-2026-98624
- netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
CVE-2026-98794
- ipvs: filter some flags received in the backup server {CVE-2026-98794}
CVE-2026-98698
- wifi: mac80211: handle empty FILS association request payload {CVE-2026-98698}
CVE-2026-98526
- llc: reserve device headroom for allocated frames {CVE-2026-98526}
CVE-2026-98532
- ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
CVE-2026-98569
- ip_gre: Reject enabling collect metadata through changelink {CVE-2026-98569}
CVE-2026-98541
- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
CVE-2026-98573
- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
CVE-2026-98567
- net: xps: reject an out of range traffic class {CVE-2026-98567}
CVE-2026-98457
- Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
CVE-2026-98460
- Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
CVE-2026-98636
- squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
CVE-2026-98772
- USB: serial: fix port tear down use-after-free {CVE-2026-98772}
CVE-2026-98697
- USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
CVE-2026-98769
- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
CVE-2026-98764
- usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764}
CVE-2026-98838
- vt: skip screen update for DEC alignment test on backgroup consoles {CVE-2026-98838}
CVE-2026-98578
- nfc: st21nfca: validate ISO15693 inventory length {CVE-2026-98578}
CVE-2026-98583
- nfc: nfcmrvl: validate helper command length before pull {CVE-2026-98583}
CVE-2026-98612
- net: usb: catc: bound the RX packet length in catc_rx_done() {CVE-2026-98612}
CVE-2026-98722
- mtd: block2mtd: Fix divide error when erase_size is zero {CVE-2026-98722}
CVE-2026-98657
- iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure {CVE-2026-98657}
CVE-2026-98623
- drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update {CVE-2026-98623}
CVE-2026-98732
- Bluetooth: btintel: fix buffer over-read in btintel_hw_error() {CVE-2026-98732}
CVE-2026-98393
- net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393}
CVE-2026-53255
- Bluetooth:…

Record: CLSA-2026-1792983235
Updated: 2026-11-02

OSV No score

net: macb: fix clk handling on PCI glue driver removal

In the Linux kernel, the following vulnerability has been resolved:

net: macb: fix clk handling on PCI glue driver removal

platform_device_unregister() may still want to use the registered clks during runtime resume callback.

Save the pointers to clks into local variables for reuse after platform device is unregistered.

BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60 Read of size 8 at addr ffff888104f85e00 by task modprobe/597

Record: CVE-2026-43015
Updated: 2026-11-02

OSVMGASA-2026-0108 No score

Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.137 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Record: MGASA-2026-0108
Updated: 2026-11-02

OSVMGASA-2026-0110 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.137 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0110
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21388-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: openSUSE-SU-2026:21388-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22742-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22742-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22769-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22769-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22812-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22812-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22835-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22835-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4120-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43014: net: macb: properly unregister fixed rate clocks (bsc#1264012).
CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
CVE-2026-53059: dm…

Record: SUSE-SU-2026:4120-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4254-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
CVE-2026-53059: dm log: fix out-of-bounds write due…

Record: SUSE-SU-2026:4254-1
Updated: 2026-11-02

OSVUSN-8567-1 No score

linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)