CVE-2026-43345

net: ipa: fix event ring index not programmed for IPA v5.0+

7.5 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

net: ipa: fix event ring index not programmed for IPA v5.0+

For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define this field in the CH_C_CNTXT_1 fmask array but used the old identifier of ERINDEX instead of CH_ERINDEX.

Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion().

At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.35%Up 0.3 points since May 9, 2026

What each source reports

CVE List Score used 7.5

net: ipa: fix event ring index not programmed for IPA v5.0+

In the Linux kernel, the following vulnerability has been resolved:

net: ipa: fix event ring index not programmed for IPA v5.0+

Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion().

At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.

Record: CVE-2026-43345
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

EUVDEUVD-2026-28629 7.5

In the Linux kernel, the following vulnerability has been resolved:

net: ipa: fix event ring index not programmed for IPA v5.0+

Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion().

At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.

Record: EUVD-2026-28629
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-7657-q549-6g59 7.5

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix event ring...

In the Linux kernel, the following vulnerability has been resolved:

net: ipa: fix event ring index not programmed for IPA v5.0+

Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion().

At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.

Record: GHSA-7657-q549-6g59
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

NVD 7.5

In the Linux kernel, the following vulnerability has been resolved:

net: ipa: fix event ring index not programmed for IPA v5.0+

Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion().

At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.

Record: CVE-2026-43345
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-43345 7.5

Record: BELL-CVE-2026-43345
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

net: ipa: fix event ring index not programmed for IPA v5.0+

In the Linux kernel, the following vulnerability has been resolved:

net: ipa: fix event ring index not programmed for IPA v5.0+

Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion().

At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.

Record: CVE-2026-43345
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 30 moreShow less

OSVDEBIAN-CVE-2026-43345 7.5

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix event ring index not programmed for IPA v5.0+ For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define this field in the CH_C_CNTXT_1 fmask array but used the old identifier of ERINDEX instead of CH_ERINDEX. Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion(). At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional.

Record: DEBIAN-CVE-2026-43345
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-2581 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: mvpp2: Prevent parser TCAM memory corruption

Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications.

Both the TCAM and SRAM tables are indirectly accessed by configuring an index register that selects the row to read or write to. This means that operations must be atomic in order to, e.g., avoid spreading writes across multiple rows. Since the shadow SRAM array is used to find free rows in the hardware table, it must also be protected in order to avoid TOCTOU errors where multiple cores allocate the same row.

This issue was detected in a situation where mvpp2_set_rx_mode() ran concurrently on two CPUs. In this particular case the MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the classifier unit to drop all incoming unicast - indicated by the rx_classifier_drops counter.(CVE-2025-22060)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix NULL pointer in can_accept_new_subflow

When testing valkey benchmark tool with MPTCP, the kernel panics in 'mptcp_can_accept_new_subflow' because subflow_req->msk is NULL.

Call trace:

mptcp_can_accept_new_subflow (./net/mptcp/subflow.c:63 (discriminator 4)) (P) subflow_syn_recv_sock (./net/mptcp/subflow.c:854) tcp_check_req (./net/ipv4/tcp_minisocks.c:863) tcp_v4_rcv (./net/ipv4/tcp_ipv4.c:2268) ip_protocol_deliver_rcu (./net/ipv4/ip_input.c:207) ip_local_deliver_finish (./net/ipv4/ip_input.c:234) ip_local_deliver (./net/ipv4/ip_input.c:254) ip_rcv_finish (./net/ipv4/ip_input.c:449) ...

According to the debug log, the same req received two SYN-ACK in a very short time, very likely because the client retransmits the syn ack due to multiple reasons.

Even if the packets are transmitted with a relevant time interval, they can be processed by the server on different CPUs concurrently). The 'subflow_req->msk' ownership is transferred to the subflow the first, and there will be a risk of a null pointer dereference here.

This patch fixes this issue by moving the 'subflow_req->msk' under the own_req == true conditional.

Note that the !msk check in subflow_hmac_valid() can be dropped, because the same check already exists under the own_req mpj branch where the code has been moved to.(CVE-2025-23145)

In the Linux kernel, the following vulnerability has been resolved:

mISDN: hfcpci: Fix warning when deleting uninitialized timer

With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat:

Record: OESA-2026-2581
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-2582 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mISDN: hfcpci: Fix warning when deleting uninitialized timer

With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat:

[ 250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0 [ 250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0 [ 250.218775] Modules linked in: hfcpci(-) mISDN_core [ 250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary) [ 250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0 [ 250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d [ 250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286 [ 250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95 [ 250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0 [ 250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39 [ 250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001 [ 250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8 [ 250.232454] FS: 00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000 [ 250.233851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0 [ 250.236117] Call Trace: [ 250.236599] <TASK> [ 250.236967] ? trace_irq_enable.constprop.0+0xd4/0x130 [ 250.237920] debug_object_assert_init+0x1f6/0x310 [ 250.238762] ? __pfx_debug_object_assert_init+0x10/0x10 [ 250.239658] ? __lock_acquire+0xdea/0x1c70 [ 250.240369] __try_to_del_timer_sync+0x69/0x140 [ 250.241172] ? __pfx___try_to_del_timer_sync+0x10/0x10 [ 250.242058] ? __timer_delete_sync+0xc6/0x120 [ 250.242842] ? lock_acquire+0x30/0x80 [ 250.243474] ? __timer_delete_sync+0xc6/0x120 [ 250.244262] __timer_delete_sync+0x98/0x120 [ 250.245015] HFC_cleanup+0x10/0x20 [hfcpci] [ 250.245704] __do_sys_delete_module+0x348/0x510 [ 250.246461] ? __pfx___do_sys_delete_module+0x10/0x10 [ 250.247338] do_syscall_64+0xc1/0x360 [ 250.247924] entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fix this by initializing hfc_tl timer with DEFINE_TIMER macro. Also, use mod_timer instead of manual timeout update.(CVE-2025-39833)

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Add support for Van Gogh SoC

The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix suspend.

Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver to crash while trying to resume afterwards due to a power hang.(CVE-2025-68334)

In the Linux kernel, the following vulnerability has been resolved:

team: Move team device type change at the end of team_port_add

Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops.

In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change.

Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense as the private data of the device still holds a struct team.

Example sequence of iproute2 commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0…

Record: OESA-2026-2582
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2026-43345 5.5

CVE-2026-43345 in linux - Patched by Root

Root has patched CVE-2026-43345 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-43345
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-43345 7.5

Record: UBUNTU-CVE-2026-43345
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVopenSUSE-SU-2026:21388-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: openSUSE-SU-2026:21388-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22433-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock…

Record: SUSE-SU-2026:22433-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22436-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).
CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).
CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).
CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).
CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).
CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).
CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).
CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).
CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).
CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev->req_status (bsc#1264561).
CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).
CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).
CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).
CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
CVE-2026-43239:…

Record: SUSE-SU-2026:22436-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22458-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock…

Record: SUSE-SU-2026:22458-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22460-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).
CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).
CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).
CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).
CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).
CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).
CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).
CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).
CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).
CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev->req_status (bsc#1264561).
CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).
CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).
CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).
CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
CVE-2026-43239:…

Record: SUSE-SU-2026:22460-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22742-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22742-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22769-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22769-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22812-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22812-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22835-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22835-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2722-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
CVE-2026-31593: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (bsc#1263124).
CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43035: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak (bsc#1263996).
CVE-2026-43036: net: use skb_header_pointer() for TCPv4 GSO frag_off check (bsc#1263993).
CVE-2026-43049: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure (bsc#1264080).
CVE-2026-43077: crypto: algif_aead - Fix minimum RX size check for decryption (bsc#1264470).
CVE-2026-43083: net: ioam6: fix OOB and missing lock (bsc#1264266).
CVE-2026-43101: ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data() (bsc#1264239).
CVE-2026-43112: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (bsc#1264437).
CVE-2026-43119: Bluetooth: hci_sync: annotate data-races around hdev->req_status (bsc#1264561).
CVE-2026-43158: xfs: fix freemap adjustments when adding xattrs to leaf blocks (bsc#1264595).
CVE-2026-43171: EFI/CPER: do not dump the entire memory region (bsc#1264549).
CVE-2026-43187: xfs: delete attr leaf freemap entries when empty (bsc#1264603).
CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock() (bsc#1264610).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43339: ipv6: prevent possible UaF in addrconf_permanent_addr() (bsc#1264763).
CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ (bsc#1265103).
CVE-2026-43405: libceph: Use u32 for non-negative values in…

Record: SUSE-SU-2026:2722-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2799-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Ultra definitions (bsc#1266290).
CVE-2025-40216: io_uring/rsrc: don't rely on user vaddr alignment (bsc#1259764).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs (bsc#1264562).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31500: Bluetooth: hci_sync: Remove remaining dependencies of hci_request (bsc#1262993).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
CVE-2026-31593: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (bsc#1263124).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).
CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated…

Record: SUSE-SU-2026:2799-1
Updated: 2026-11-02

OSVUSN-8567-1 No score

linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)