CVE-2026-43441

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

7.5 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bonding ARP/NS validation is enabled, an IPv6 NS/NA packet received on a slave can reach bond_validate_na(), which calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can crash in __ipv6_chk_addr_and_flags().

BUG: kernel NULL pointer dereference, address: 00000000000005d8 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170 Call Trace: <IRQ> ipv6_chk_addr+0x1f/0x30 bond_validate_na+0x12e/0x1d0 [bonding] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] bond_rcv_validate+0x1a0/0x450 [bonding] bond_handle_frame+0x5e/0x290 [bonding] ? srso_alias_return_thunk+0x5/0xfbef5 __netif_receive_skb_core.constprop.0+0x3e8/0xe50 ? srso_alias_return_thunk+0x5/0xfbef5 ? update_cfs_rq_load_avg+0x1a/0x240 ? srso_alias_return_thunk+0x5/0xfbef5 ? __enqueue_entity+0x5e/0x240 __netif_receive_skb_one_core+0x39/0xa0 process_backlog+0x9c/0x150 __napi_poll+0x30/0x200 ? srso_alias_return_thunk+0x5/0xfbef5 net_rx_action+0x338/0x3b0 handle_softirqs+0xc9/0x2a0 do_softirq+0x42/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x62/0x70 __dev_queue_xmit+0x2d3/0x1000 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? packet_parse_headers+0x10a/0x1a0 packet_sendmsg+0x10da/0x1700 ? kick_pool+0x5f/0x140 ? srso_alias_return_thunk+0x5/0xfbef5 ? __queue_work+0x12d/0x4f0 __sys_sendto+0x1f3/0x220 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x101/0xf80 ? exc_page_fault+0x6e/0x170 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>

Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.58%Up 0.6 points since May 9, 2026

What each source reports

CVE List Score used 7.5

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().

Record: CVE-2026-43441
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

EUVDEUVD-2026-28747 7.5

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().

Record: EUVD-2026-28747
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pfqp-2whq-57g2 7.5

In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fix nd_tbl...

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().

Record: GHSA-pfqp-2whq-57g2
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

NVD 7.5

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().

Record: CVE-2026-43441
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVBELL-CVE-2026-43441 7.5

Record: BELL-CVE-2026-43441
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().

Record: CVE-2026-43441
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 28 moreShow less

OSVDEBIAN-CVE-2026-43441 7.5

In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never initialized because inet6_init() exits before ndisc_init() is called which initializes it. If bonding ARP/NS validation is enabled, an IPv6 NS/NA packet received on a slave can reach bond_validate_na(), which calls bond_has_this_ip6(). That path calls ipv6_chk_addr() and can crash in __ipv6_chk_addr_and_flags(). BUG: kernel NULL pointer dereference, address: 00000000000005d8 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:__ipv6_chk_addr_and_flags+0x69/0x170 Call Trace: <IRQ> ipv6_chk_addr+0x1f/0x30 bond_validate_na+0x12e/0x1d0 [bonding] ? __pfx_bond_handle_frame+0x10/0x10 [bonding] bond_rcv_validate+0x1a0/0x450 [bonding] bond_handle_frame+0x5e/0x290 [bonding] ? srso_alias_return_thunk+0x5/0xfbef5 __netif_receive_skb_core.constprop.0+0x3e8/0xe50 ? srso_alias_return_thunk+0x5/0xfbef5 ? update_cfs_rq_load_avg+0x1a/0x240 ? srso_alias_return_thunk+0x5/0xfbef5 ? __enqueue_entity+0x5e/0x240 __netif_receive_skb_one_core+0x39/0xa0 process_backlog+0x9c/0x150 __napi_poll+0x30/0x200 ? srso_alias_return_thunk+0x5/0xfbef5 net_rx_action+0x338/0x3b0 handle_softirqs+0xc9/0x2a0 do_softirq+0x42/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x62/0x70 __dev_queue_xmit+0x2d3/0x1000 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? packet_parse_headers+0x10a/0x1a0 packet_sendmsg+0x10da/0x1700 ? kick_pool+0x5f/0x140 ? srso_alias_return_thunk+0x5/0xfbef5 ? __queue_work+0x12d/0x4f0 __sys_sendto+0x1f3/0x220 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x101/0xf80 ? exc_page_fault+0x6e/0x170 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Fix this by checking ipv6_mod_enabled() before dispatching IPv6 packets to bond_na_rcv(). If IPv6 is disabled, return early from bond_rcv_validate() and avoid the path to ipv6_chk_addr().

Record: DEBIAN-CVE-2026-43441
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2026-43441 5.5

CVE-2026-43441 in linux - Patched by Root

Root has patched CVE-2026-43441 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-43441
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-43441 8.2

Record: UBUNTU-CVE-2026-43441
CVSS 4.0: 8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVopenSUSE-SU-2026:20826-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

Record: openSUSE-SU-2026:20826-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21834-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

Record: SUSE-SU-2026:21834-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21841-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

Record: SUSE-SU-2026:21841-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21845-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

Record: SUSE-SU-2026:21845-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21860-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…

Record: SUSE-SU-2026:21860-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21876-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
CVE-2026-31407:…

Record: SUSE-SU-2026:21876-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21877-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
CVE-2026-31407:…

Record: SUSE-SU-2026:21877-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21916-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
CVE-2026-31407:…

Record: SUSE-SU-2026:21916-1
Updated: 2026-11-02

OSVSUSE-SU-2026:21919-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
CVE-2026-23461: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user (bsc#1261707).
CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on wakeup race (bsc#1261694).
CVE-2026-31400: sunrpc: fix cache_request leak in cache_release (bsc#1261645).
CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
CVE-2026-31404: xfs: avoid dereferencing log items after push callbacks (bsc#1261628).
CVE-2026-31407:…

Record: SUSE-SU-2026:21919-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2217-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
CVE-2026-23457: netfilter: nf_conntrack_sip: fix…

Record: SUSE-SU-2026:2217-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2238-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
CVE-2025-68310: s390/pci: Use pci_uevent_ers() in PCI recovery (bsc#1255160).
CVE-2025-71183: btrfs: always detect conflicting inodes when logging inode refs (bsc#1257631).
CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
CVE-2026-23276: net: move dev_xmit_recursion() helpers to net/core/dev.h (bsc#1260012).
CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
CVE-2026-23346: mm/ioremap: define generic_ioremap_prot() and generic_iounmap() (bsc#1260529).
CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
CVE-2026-23395: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (bsc#1260580).
CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune (bsc#1261507).
CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
CVE-2026-23456: netfilter: nf_conntrack_h323:…

Record: SUSE-SU-2026:2238-1
Updated: 2026-11-02

OSVUSN-8567-1 No score

linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)