CVE-2026-43110

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check. Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array. [add missing wifi prefix]

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: check tdls flag in ieee80211_tdls_oper

When NL80211_TDLS_ENABLE_LINK is called, the code only checks if the station exists but not whether it is actually a TDLS station. This allows the operation to proceed for non-TDLS stations, causing unintended side effects like modifying channel context and HT protection before failing.

Add a check for sta->sta.tdls early in the ENABLE_LINK case, before any side effects occur, to ensure the operation is only allowed for actual TDLS peers.(CVE-2026-43052)

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: validate bsscfg indices in IF events

brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check.

Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array.

add missing wifi prefix

In the Linux kernel, the following vulnerability has been resolved:

HID: roccat: fix use-after-free in roccat_report_event

roccat_report_event() iterates over the device->readers list without holding the readers_lock. This allows a concurrent roccat_release() to remove and free a reader while it's still being accessed, leading to a use-after-free.

Protect the readers list traversal with the readers_lock mutex.(CVE-2026-43111)

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()

The kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8 bytes via memset without checking the buffer size parameter. This allows unprivileged userspace to trigger an out-of bounds kernel memory write by passing a small buffer, leading to potential privilege escalation.(CVE-2026-43206)

In the Linux kernel, the following vulnerability has been resolved:

ext4: drop extent cache after doing PARTIAL_VALID1 zeroout

When splitting an unwritten extent in the middle and converting it to initialized in ext4_split_extent() with the EXT4_EXT_MAY_ZEROOUT and EXT4_EXT_DATA_VALID2 flags set, it could leave a stale unwritten extent.

Assume we have an unwritten file and buffered write in the middle of it without dioread_nolock enabled, it will allocate blocks as written extent.

   0  A      B  N
   [UUUUUUUUUUUU] on-disk extent      U: unwritten extent
   [UUUUUUUUUUUU] extent status tree
   [--DDDDDDDD--]                     D: valid data
      |<-  ->| ----> this range needs to be initialized

ext4_split_extent() first try to split this extent at B with EXT4_EXT_DATA_PARTIAL_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but ext4_split_extent_at() failed to split this extent due to temporary lack of space. It zeroout B to N and leave the entire extent as unwritten.

   0  A      B  N
   [UUUUUUUUUUUU] on-disk extent
   [UUUUUUUUUUUU] extent status tree
   [--DDDDDDDDZZ]                     Z: zeroed data

ext4_split_extent() then try to split this extent at A with EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and leave an written extent from A to N.

   0  A      B  N
   [UUWWWWWWWWWW] on-disk extent      W: written extent
   [UUUUUUUUUUUU] extent status tree
   [--DDDDDDDDZZ]

Finally ext4_map_create_blocks() only insert extent A to B to the extent status tree, and leave an stale unwritten extent in the status tree.

   0  A      B  N
   [UUWWWWWWWWWW] on-disk extent      W: written extent
   [UUWWWWWWWWUU] extent status tree
   [--DDDDDDDDZZ]

Fix this issue by always cached extent status entry after zeroing out the second part.(CVE-2026-45892)

In the Linux kernel, the following vulnerability has been resolved:

ext4: drop extent cache when…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)

• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

• kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

• kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

• kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)

• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

• kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)

• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

• kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

• kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

• kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)

• kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

• kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)

• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

• kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)

• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)

• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-43110 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-43110 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-43110 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-43110 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: validate bsscfg indices in IF events brcmf_fweh_handle_if_event() validates the firmware-provided interface index before it touches drvr->iflist[], but it still uses the raw bsscfgidx field as an array index without a matching range check. Reject IF events whose bsscfg index does not fit in drvr->iflist[] before indexing the interface array. [add missing wifi prefix]

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)
• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
• kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
• kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)
• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
• kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
• kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
• kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
• kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)
• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
• kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
• kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
• kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)
• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
• kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ALSA: usb-audio: Use the right limit for PCM OOB check
• ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
• cpufreq: governor: Free dbs_data directly when gov->init() fails {CVE-2026-43328}
• rcu: Fix rcu_read_unlock() deadloop due to softirq
• rcu: Fix racy re-initialization of irq_work causing hangs
• RDMA/efa: Fix possible deadlock {CVE-2026-31493}
• RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493}
• RDMA/efa: Improve admin completion context state machine {CVE-2026-31493}
• RDMA/efa: Check stored completion CTX command ID with received one {CVE-2026-31493}
• RDMA/efa: Extend admin timeout error print
• RDMA/efa: Properly handle unexpected AQ completions {CVE-2026-31493}
• rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• rtnetlink: Allocate vfinfo size for VF GUIDs when supported {CVE-2025-22075}
• kernel/printk/index.c: fix memory leak with using debugfs_lookup() {CVE-2023-53402}
• wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
• md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() {CVE-2023-53210}
• exfat: fix the infinite loop in exfat_readdir() {CVE-2024-57940}
• af_netlink: Fix shift out of bounds in group mask calculation {CVE-2022-49197}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
• efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}
• kernel/resource: fix kfree() of bootmem memory again {CVE-2022-49190}
• smb: client: fix warning in cifs_smb3_do_mount() {CVE-2023-53230}
• sctp: Fix null-ptr-deref in reuseport_add_sock(). {CVE-2024-44935}
• RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages {CVE-2024-50208}
• drm/amdgpu: avoid using null object of framebuffer {CVE-2024-41093}
• firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
• ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738}
• net: hinic: fix memory leak when reading function table {CVE-2022-50438}
• device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() {CVE-2022-49752}
• libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232}
• usbnet: fix memory leak in error case {CVE-2022-49657}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• seccomp: Move copy_seccomp() to no failure path. {CVE-2022-50661}
• net/mlx5: fs, lock FTE when checking if active {CVE-2024-53121}
• nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756}
• leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587}
• bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener {CVE-2023-52986}
• RDMA/uverbs: Prevent integer overflow issue {CVE-2024-57890}
• sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125}
• tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() {CVE-2022-49800}
• kprobes: Fix check for probe enabled in kill_kprobe() {CVE-2022-50266}
• NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 {CVE-2024-26870}
• i915/perf: Fix NULL deref bugs with drm_dbg() calls {CVE-2023-52788}
• can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357}
• regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode {CVE-2022-50558}
• wifi: cfg80211: Set correct chandef when starting CAC {CVE-2024-49937}
• netfilter: nf_tables: prevent nf_skb_duplicated corruption {CVE-2024-49952}
• can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830}
• bpf: Fix…

• irqchip: Fix refcount leak in platform_irqchip_probe {CVE-2023-53610}
• IB/hfi1: Fix a memleak in init_credit_return {CVE-2024-26839}
• RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() {CVE-2026-23335}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() {CVE-2025-71100}
• RDMA/core: always drop device refcount in ib_del_sub_device_and_put() {CVE-2025-71157}
• drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table {CVE-2024-58052}
• ionic: Fix netdev notifier unregister on failure {CVE-2024-56715}
• uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind {CVE-2024-46739}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• usb: typec: altmodes/displayport: do not index invalid pin_assignments {CVE-2025-38391}
• crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init {CVE-2023-52616}
• eventpoll: defer struct eventpoll free to RCU grace period {CVE-2026-43074}
• wifi: brcmsmac: Fix dma_free_coherent() size {CVE-2026-31661}
• SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120}
• netfilter: nf_conntrack_expect: skip expectations in other netns via proc {CVE-2026-31496}
• platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data {CVE-2026-23370}
• crypto: bcm - add error check in the ahash_hmac_init function {CVE-2024-56681}
• nvme-pci: ensure we're polling a polled queue {CVE-2026-31523}
• mmc: vub300: fix NULL-deref on disconnect {CVE-2026-31651}
• kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() {CVE-2023-52936}
• ipmi: ipmb: Add check devm_kasprintf() returned value {CVE-2024-58051}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ASoC: amd: fix memory leak in acp3x pdm dma ops {CVE-2026-23190}
• udp: Deal with race between UDP socket address change and rehash {CVE-2024-57974}
• team: avoid NETDEV_CHANGEMTU event when unregistering slave {CVE-2026-43234}
• tcp: secure_seq: add back ports to TS offset {CVE-2026-23247}
• udp: Fix wildcard bind conflict check when using hash2 {CVE-2026-31503}
• netfilter: nft_set_pipapo: prevent overflow in lookup table allocation {CVE-2025-38162}
• rxrpc: Fix recv-recv race of completed call {CVE-2025-38524}
• netfilter: nf_tables: reject duplicate device on updates {CVE-2025-38678}
• nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
• crypto: af_alg - limit RX SG extraction by receive buffer budget {CVE-2026-31677}
• xfrm: account XFRMA_IF_ID in aevent size calculation {CVE-2026-43107}
• KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop {CVE-2025-21839}
• perf: Fix sample vs do_exit() {CVE-2025-38424}
• netfilter: nf_tables: avoid chain re-validation if possible {CVE-2025-71160}
• ksm: use range-walk function to jump over holes in scan_get_next_rmap_item {CVE-2025-68211}
• net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime {CVE-2025-38470}
• net: add proper RCU protection to /proc/net/ptype {CVE-2026-23255}
• ALSA: ctxfi: Check the error for index mapping {CVE-2026-31777}
• rseq: Fix segfault on registration when rseq_cs is non-zero {CVE-2025-38067}
• RDMA/core: Don't expose hw_counters outside of init net namespace {CVE-2025-22089}
• net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv {CVE-2026-22996}
• Input: synaptics - fix crash when enabling pass-through port {CVE-2025-21746}
• wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579}
• ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() {CVE-2025-38305}
• driver core: fix potential NULL pointer dereference in dev_uevent() {CVE-2025-37800}
• dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
• net: let net.core.dev_weight always be non-zero {CVE-2025-21806}
• exec:…

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• kyber: fix out of bounds access when preempted {CVE-2021-46984}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• tls: separate no-async decryption request handling from async {CVE-2024-58240}
• ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• nfsd: fix use-after-free due to delegation race {CVE-2021-47506}
• drm: bridge/panel: Cleanup connector on bridge detach {CVE-2021-47063}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer {CVE-2021-47226}
• kvm: LAPIC: Restore guard to prevent illegal APIC register access {CVE-2021-47255}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) {CVE-2019-7221}
• RDMA/umad: Reject negative data_len in…

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• drm/i915/gem: Really move i915_gem_context.link under ref protection {CVE-2022-48662}
• drm/i915: Release i915_gem_context from a worker {CVE-2022-48662}
• KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
• skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
• nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
• icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
• RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device {CVE-2023-53393}
• scsi: target: iscsi: Fix a race condition between login_work and the login thread {CVE-2022-50350}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• ice: Fix memory corruption in VF driver {CVE-2022-49722}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• netfilter: nf_conntrack_helper: pass helper to…

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
• scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
• i40e: increase max descriptors for XL710
• e1000e: fix heap overflow in e1000_set_eeprom
• vsock: avoid to close connected socket after the timeout
• ext4: fix use-after-free in ext4_orphan_cleanup
• ext4: lost matching-pair of trace in ext4_truncate
• ext4: allow ext4_truncate() to return an error
• net: sched: sch_teql: fix null-pointer dereference
• drm/virtio: move drm_connector_update_edid_property() call
• cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
• cifs: serialise setting of cifsInodeInfo::oplock
• cifs: serialise DIO and buffered IO
• RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024}
• netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
• iavf: Fix reset error handling
• RDMA/rxe: Fix incomplete state save in rxe_requester
• scsi: qla2xxx: Fix bsg_done() causing double free
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• net: check iov bounds in memcpy_from_msg() {CVE-2018-16885}
• md/bitmap: fix GPF in write_page caused by resize race {CVE-2026-43163}
• RDMA/rxe: Fix lines missed in backport of Fix incomplete state save in rxe_requester
• ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• dlm: fix buffer overflow from negative len in dlm_search_rsb_tree {CVE-2026-43125}
• RDMA/rxe: Fix double free in rxe_srq_from_init {CVE-2026-45852}
• tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• net: sched: act_csum: validate nested VLAN headers {CVE-2026-31684}
• xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090}
• rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-53166}
• RDMA/rxe: Zero out index member of struct rxe_queue

• scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
• scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
• i40e: increase max descriptors for XL710
• e1000e: fix heap overflow in e1000_set_eeprom
• vsock: avoid to close connected socket after the timeout
• ext4: fix use-after-free in ext4_orphan_cleanup
• ext4: lost matching-pair of trace in ext4_truncate
• ext4: allow ext4_truncate() to return an error
• net: sched: sch_teql: fix null-pointer dereference
• drm/virtio: move drm_connector_update_edid_property() call
• cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
• cifs: serialise setting of cifsInodeInfo::oplock
• cifs: serialise DIO and buffered IO
• RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024}
• netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
• iavf: Fix reset error handling
• RDMA/rxe: Fix incomplete state save in rxe_requester
• scsi: qla2xxx: Fix bsg_done() causing double free
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• net: check iov bounds in memcpy_from_msg() {CVE-2018-16885}
• md/bitmap: fix GPF in write_page caused by resize race {CVE-2026-43163}
• RDMA/rxe: Fix lines missed in backport of Fix incomplete state save in rxe_requester
• ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• dlm: fix buffer overflow from negative len in dlm_search_rsb_tree {CVE-2026-43125}
• RDMA/rxe: Fix double free in rxe_srq_from_init {CVE-2026-45852}
• tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• net: sched: act_csum: validate nested VLAN headers {CVE-2026-31684}
• xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090}
• rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-53166}
• RDMA/rxe: Zero out index member of struct rxe_queue

• scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
• scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
• i40e: increase max descriptors for XL710
• e1000e: fix heap overflow in e1000_set_eeprom
• vsock: avoid to close connected socket after the timeout
• ext4: fix use-after-free in ext4_orphan_cleanup
• ext4: lost matching-pair of trace in ext4_truncate
• ext4: allow ext4_truncate() to return an error
• net: sched: sch_teql: fix null-pointer dereference
• drm/virtio: move drm_connector_update_edid_property() call
• cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level()
• cifs: serialise setting of cifsInodeInfo::oplock
• cifs: serialise DIO and buffered IO
• RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024}
• netfilter: nf_tables: fix use-after-free in nf_tables_addchain()
• iavf: Fix reset error handling
• RDMA/rxe: Fix incomplete state save in rxe_requester
• scsi: qla2xxx: Fix bsg_done() causing double free
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• net: check iov bounds in memcpy_from_msg() {CVE-2018-16885}
• md/bitmap: fix GPF in write_page caused by resize race {CVE-2026-43163}
• RDMA/rxe: Fix lines missed in backport of Fix incomplete state save in rxe_requester
• ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• dlm: fix buffer overflow from negative len in dlm_search_rsb_tree {CVE-2026-43125}
• RDMA/rxe: Fix double free in rxe_srq_from_init {CVE-2026-45852}
• tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• net: sched: act_csum: validate nested VLAN headers {CVE-2026-31684}
• xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090}
• rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-53166}
• RDMA/rxe: Zero out index member of struct rxe_queue

• CVE-2025-68214
  • timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214}
• CVE-2024-58093
  • PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-64095
  • batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64096
  • batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64218
  • batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64115
  • vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• CVE-2026-64114
  • ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• CVE-2026-64113
  • ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• CVE-2026-64103
  • scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2025-39686
  • comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
• CVE-2025-38068
  • crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• CVE-2025-39901
  • i40e: remove read access to debugfs files {CVE-2025-39901}
• CVE-2023-54207
  • HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
• CVE-2023-53446
  • PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2025-71152
  • net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152}
• CVE-2026-53131
  • netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• CVE-2026-31685
  • netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-43458
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
• CVE-2023-53338
  • lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• CVE-2026-43076…

• CVE-2025-68214
  • timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214}
• CVE-2024-58093
  • PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-64095
  • batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64096
  • batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64218
  • batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64115
  • vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• CVE-2026-64114
  • ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• CVE-2026-64113
  • ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• CVE-2026-64103
  • scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2025-39686
  • comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
• CVE-2025-38068
  • crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• CVE-2025-39901
  • i40e: remove read access to debugfs files {CVE-2025-39901}
• CVE-2023-54207
  • HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
• CVE-2023-53446
  • PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2025-71152
  • net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152}
• CVE-2026-53131
  • netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• CVE-2026-31685
  • netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-43458
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
• CVE-2023-53338
  • lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• CVE-2026-43076…

• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-46175
  • f2fs: fix fsck inconsistency caused by FGGC of node block {CVE-2026-46175}
• CVE-2025-68254
  • staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing {CVE-2025-68254}
• CVE-2025-68255
  • staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing {CVE-2025-68255}
• CVE-2026-64268
  • RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• CVE-2025-68286
  • drm/amd/display: Check NULL before accessing {CVE-2025-68286}
• CVE-2026-53024
  • greybus: raw: fix use-after-free if write is called after disconnect {CVE-2026-53024}
• CVE-2026-53025
  • greybus: raw: fix use-after-free on cdev close {CVE-2026-53025}
• CVE-2026-52934
  • batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
• CVE-2025-68303
  • platform/x86: intel: punit_ipc: fix memory corruption {CVE-2025-68303}
• CVE-2026-64280
  • fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64109
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-53329
  • drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64189
  • netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• CVE-2026-31786
  • Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
• CVE-2025-68799
  • caif: fix integer underflow in cffrml_receive() {CVE-2025-68799}
• CVE-2025-68302
  • net: sxgbe: fix potential NULL dereference in sxgbe_rx() {CVE-2025-68302}
• CVE-2025-40243
  • hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() {CVE-2025-40243}
• CVE-2025-40233
  • ocfs2: clear extent cache after moving/defragmenting extents {CVE-2025-40233}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2026-31657
  • batman-adv: hold claim backbone gateways by reference {CVE-2026-31657}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-23216
  • scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} *…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2022-50053: iavf: Fix reset error handling (bsc#1245038).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1. (bsc#1243603).
• CVE-2024-50082: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (bsc#1232500 bsc#1262778).
• CVE-2025-68185: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing (bsc#1255135).
• CVE-2025-71118: ACPICA: Avoid walking the Namespace if start_node is NULL (bsc#1256763).
• CVE-2025-71238: scsi: qla2xxx: Fix bsg_done() causing double free (bsc#1259186).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23290: net: usb: pegasus: validate USB endpoints (bsc#1260533).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23312: net: usb: kaweth: validate USB endpoints (bsc#1260561).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23378: act_ife: load meta modules before tcf_idr_check_alloc() (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-31393: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access (bsc#1261719).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations (bsc#1261632).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31411: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (bsc#1261752).
• CVE-2026-31416: netfilter: nfnetlink_log: account for netlink header size (bsc#1262100).
• CVE-2026-31422: net/sched: cls_flow: fix NULL pointer dereference on shared blocks (bsc#1262054).
• CVE-2026-31423: net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() (bsc#1262063).
• CVE-2026-31424: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (bsc#1262053).
• CVE-2026-31425: rds: ib: reject FRMR registration before IB connection is established (bsc#1262074).
• CVE-2026-31427: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp (bsc#1262086).
• CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (bsc#1262087).
• CVE-2026-31496: netfilter: nf_conntrack_expect: skip…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2021-47103: inet: fully convert sk->sk_rx_dst to RCU rules (bsc#1221010).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
• CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
• CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651).
• CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).
• CVE-2026-43334: Bluetooth: SMP: force responder MITM…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
• CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
• CVE-2026-31407:…

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31470: virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (bsc#1262665).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31505: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (bsc#1263093).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31528: perf: Make sure to use pmu_ctx->pmu for groups (bsc#1263001).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31622: NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (bsc#1263797).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-46331: kernel: net/sched: fix pedit partial COW leading to page cache
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43038: ipv6: icmp: clear skb2->cb…