CVE-2026-43092

xsk: validate MTU against usable frame size on bind

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate MTU against usable frame size on bind

AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk.

This becomes a problem since we started to respect tailroom which is subtracted from chunk_size (among with headroom). 2k chunk size might not provide enough space for standard 1500 MTU, so let us catch such settings at bind time. Furthermore, validate whether underlying HW will be able to satisfy configured MTU wrt XSK's frame size multiplied by supported Rx buffer chain length (that is exposed via net_device::xdp_zc_max_segs).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.12%Up 0.1 points since May 6, 2026

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate MTU against usable frame size on bind

AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk.

Record: CVE-2026-43092
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

CVE List No score

xsk: validate MTU against usable frame size on bind

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate MTU against usable frame size on bind

AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk.

Record: CVE-2026-43092
Updated: 2026-11-02

EUVDEUVD-2026-27594 No score

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate MTU against usable frame size on bind

AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk.

Record: EUVD-2026-27594
Updated: 2026-11-02

GitHub AdvisoriesGHSA-gpc7-hgpf-xq94 5.5

In the Linux kernel, the following vulnerability has been resolved: xsk: validate MTU against...

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate MTU against usable frame size on bind

AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk.

Record: GHSA-gpc7-hgpf-xq94
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-43092 5.5

Record: BELL-CVE-2026-43092
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-43092 5.5

In the Linux kernel, the following vulnerability has been resolved: xsk: validate MTU against usable frame size on bind AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk. This becomes a problem since we started to respect tailroom which is subtracted from chunk_size (among with headroom). 2k chunk size might not provide enough space for standard 1500 MTU, so let us catch such settings at bind time. Furthermore, validate whether underlying HW will be able to satisfy configured MTU wrt XSK's frame size multiplied by supported Rx buffer chain length (that is exposed via net_device::xdp_zc_max_segs).

Record: DEBIAN-CVE-2026-43092
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 29 moreShow less

OSVROOT-OS-UBUNTU-2404-CVE-2026-43092 5.5

CVE-2026-43092 in linux - Patched by Root

Root has patched CVE-2026-43092 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-43092
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-43092 8.4

Record: UBUNTU-CVE-2026-43092
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVCLSA-2026-1789986443 No score

kernel: Fix of 121 CVEs

dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
mm/damon/core: validate ranges in damon_set_regions() {CVE-2026-68165}
netpoll: Fix deadlock in memory allocation under spinlock {CVE-2025-68169}
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size {CVE-2026-68258}
gve: fix Rx queue stall on alloc failure {CVE-2026-68129}
drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234}
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE {CVE-2026-68159}
media: v4l2-ctrls: validate HEVC active reference counts {CVE-2026-68206}
drm/i915/hdcp: check streams[] bounds before overflow {CVE-2026-68253}
drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() {CVE-2026-68245}
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() {CVE-2026-68115}
drm/i915: Return NULL on error in active_instance {CVE-2026-68248}
smb: client: validate DFS referral PathConsumed {CVE-2026-68343}
ext4: fix use-after-free in update_super_work when racing with umount {CVE-2026-31446}
debugobjects: Plug race against a concurrent OOM disable {CVE-2026-68090}
HID: wacom: stop hardware after post-start probe failures {CVE-2026-68091}
drm/xe/pt: Reset current_op in xe_pt_update_ops_init() {CVE-2026-68264}
net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD {CVE-2026-68288}
drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() {CVE-2026-68113}
openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}
drm/amd/display: use kvzalloc to allocate struct dc {CVE-2026-68436}
drm/i915/gem: Add missing nospec on parallel submit slot {CVE-2026-68269}
Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update {CVE-2026-68394}
sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162}
wifi: mt76: mt7925: fix crash in reset link replay {CVE-2026-68307}
Bluetooth: hci_sync: extend conn_hash lookup critical sections {CVE-2026-68393}
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU {CVE-2026-68243}
block: fix memory leak in __blkdev_issue_zero_pages {CVE-2026-68348}
drm/amdgpu/gfx: fix cleaner shader IB buffer overflow {CVE-2026-68276}
tracing: Do not call map->ops->elt_free() if elt_alloc() fails {CVE-2026-64173}
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362}
ovl: check access to copy_file_range source with src mounter creds {CVE-2026-68448}
drm/nouveau: fix reversed error cleanup order in ucopy functions {CVE-2026-68271}
vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
drm/vmwgfx: Validate vmw_surface_metadata::array_size {CVE-2026-68446}
net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM {CVE-2026-68296}
Input: elan_i2c - prevent division by zero and arithmetic underflow {CVE-2026-64275}
iomap: fix out-of-bounds bitmap_set() with zero-length range {CVE-2026-68145}
vsock: fix lock inversion in vsock_assign_transport() {CVE-2025-40231}
ASoC: nau8821: Cancel delayed work on component remove {CVE-2026-45963}
ext4: validate p_idx bounds in ext4_ext_correct_indexes {CVE-2026-31449}
ipc: fix memleak if msg_init_ns failed in create_ipc_ns {CVE-2024-53175}
tls: make sure to abort the stream if headers are bogus {CVE-2025-39946}
ipv6: prevent infinite loop in rt6_nlmsg_size() {CVE-2025-38588}
gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL {CVE-2026-23386}
xsk: validate MTU against usable frame size on bind {CVE-2026-43092}
RDMA/irdma: Harden depth calculation functions {CVE-2026-31491}
iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() {CVE-2026-31505}
net/ip6_tunnel: Prevent perpetual tunnel growth {CVE-2025-40173}
net/mlx5: Fix deadlock between devlink lock and esw->wq {CVE-2026-43468}
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458}
fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling {CVE-2026-52946}
nvmet: move async event…

Record: CLSA-2026-1789986443
Updated: 2026-11-02

OSV No score

xsk: validate MTU against usable frame size on bind

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate MTU against usable frame size on bind

AF_XDP bind currently accepts zero-copy pool configurations without verifying that the device MTU fits into the usable frame space provided by the UMEM chunk.

Record: CVE-2026-43092
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21388-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: openSUSE-SU-2026:21388-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22742-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22742-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22769-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22769-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22809-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
CVE-2026-43199: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (bsc#1264556).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593).
CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213).
CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).
CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).
CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495).
CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).
CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo()…

Record: SUSE-SU-2026:22809-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22810-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
CVE-2026-43199: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (bsc#1264556).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593).
CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213).
CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).
CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).
CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495).
CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).
CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with…

Record: SUSE-SU-2026:22810-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22812-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22812-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22835-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22835-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22903-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
CVE-2026-43199: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (bsc#1264556).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593).
CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213).
CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).
CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).
CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495).
CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).
CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo()…

Record: SUSE-SU-2026:22903-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22904-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
CVE-2026-43199: net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (bsc#1264556).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593).
CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
CVE-2026-45987: KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 (bsc#1267213).
CVE-2026-45997: scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails (bsc#1266740).
CVE-2026-46046: ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() (bsc#1266726).
CVE-2026-46050: md/raid10: fix deadlock with check operation and nowait requests (bsc#1266686).
CVE-2026-46051: md/raid5: fix soft lockup in retry_aligned_read() (bsc#1267360).
CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
CVE-2026-46059: KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN (bsc#1267495).
CVE-2026-46099: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (bsc#1266722).
CVE-2026-46161: md/raid10: fix divide-by-zero in setup_geo() with…

Record: SUSE-SU-2026:22904-1
Updated: 2026-11-02

OSVSUSE-SU-2026:3130-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593 bsc#1264419).
CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).
CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805). -…

Record: SUSE-SU-2026:3130-1
Updated: 2026-11-02

OSVSUSE-SU-2026:3166-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: iommu/amd: Use maximum Event log buffer size when SNP is enabled on Family 0x19 (bsc#1243603).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31503: udp: Fix wildcard bind conflict check when using hash2 (bsc#1263077).
CVE-2026-43019: Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync (bsc#1264003).
CVE-2026-43057: net: mpls: error out if inner headers are not set (bsc#1264056).
CVE-2026-43092: xsk: validate MTU against usable frame size on bind (bsc#1264270).
CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
CVE-2026-43157: octeontx2-af: CGX: fix bitmap leaks (bsc#1264624).
CVE-2026-43167: xfrm: always flush state and policy upon NETDEV_UNREGISTER event (bsc#1264580).
CVE-2026-43191: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35 (bsc#1264548).
CVE-2026-43194: net: consume xmit errors of GSO frames (bsc#1264304).
CVE-2026-43199: net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (bsc#1264556).
CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
CVE-2026-43205: dpaa2-switch: validate num_ifs to prevent out-of-bounds write (bsc#1264328).
CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
CVE-2026-43240: ima: verify the previous kernel's IMA buffer lies in addressable RAM (bsc#1264386).
CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
CVE-2026-43248: vhost: move vdpa group bound check to vhost_vdpa (bsc#1264302).
CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1260593 bsc#1264419).
CVE-2026-43260: bnxt_en: Fix RSS context delete logic (bsc#1264429).
CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (bsc#1264853).
CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
CVE-2026-43320: drm/amd/display: Fix dsc eDP issue (bsc#1264987).
CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (bsc#1265112).
CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (bsc#1264997).
CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq (bsc#1264978).
CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues (bsc#1264731).
CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
CVE-2026-45920: ext4: fix dirtyclusters double decrement on fs shutdown (bsc#1266893).
CVE-2026-45922: RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (bsc#1266805). -…

Record: SUSE-SU-2026:3166-1
Updated: 2026-11-02

OSVUSN-8567-1 No score

linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)