CVE-2026-43458

serial: caif: hold tty->link reference in ldisc_open and ser_release

7.8 HighFix available

What does this mean?

: 7.8v3.1, from NVD
: 0.12%1st percentile
Fixed in: 6.1.167-r0linux-lts
Published: May 8, 2026
Modified: November 11, 2026
Weakness: CWE-416
Also known as: BELL-CVE-2026-43458CLSA-2026-1789373487CLSA-2026-1789373515CLSA-2026-1789460387CLSA-2026-1791185545DEBIAN-CVE-2026-43458EUVD-2026-28764GHSA-27j8-6q5h-m6jx
Show 35 moreShow less
ROOT-OS-DEBIAN-11-CVE-2026-43458ROOT-OS-UBUNTU-2204-CVE-2026-43458ROOT-OS-UBUNTU-2404-CVE-2026-43458SUSE-SU-2026:22742-1SUSE-SU-2026:22769-1SUSE-SU-2026:22812-1SUSE-SU-2026:22835-1UBUNTU-CVE-2026-43458USN-8567-1USN-8574-1USN-8574-2USN-8574-3USN-8575-1USN-8575-2USN-8575-3USN-8576-1USN-8576-2USN-8595-1USN-8595-2USN-8595-3USN-8596-1USN-8606-1USN-8607-1USN-8608-1USN-8609-1USN-8610-1USN-8619-1USN-8620-1USN-8620-2USN-8620-3USN-8620-4USN-8665-1USN-8668-1USN-8668-2openSUSE-SU-2026:21388-1

In the Linux kernel, the following vulnerability has been resolved:

serial: caif: hold tty->link reference in ldisc_open and ser_release

A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port.

Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path.

With this change applied, the reproducer no longer triggers the UAF in my testing.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.12%Up 0.1 points since May 9, 2026

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

serial: caif: hold tty->link reference in ldisc_open and ser_release

A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port.

Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path.

With this change applied, the reproducer no longer triggers the UAF in my testing.

Record: CVE-2026-43458
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

serial: caif: hold tty->link reference in ldisc_open and ser_release

In the Linux kernel, the following vulnerability has been resolved:

serial: caif: hold tty->link reference in ldisc_open and ser_release

A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port.

Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path.

With this change applied, the reproducer no longer triggers the UAF in my testing.

Record: CVE-2026-43458
Updated: 2026-11-02

EUVDEUVD-2026-28764 No score

In the Linux kernel, the following vulnerability has been resolved:

serial: caif: hold tty->link reference in ldisc_open and ser_release

A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port.

Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path.

With this change applied, the reproducer no longer triggers the UAF in my testing.

Record: EUVD-2026-28764
Updated: 2026-11-02

GitHub AdvisoriesGHSA-27j8-6q5h-m6jx 7.8

In the Linux kernel, the following vulnerability has been resolved: serial: caif: hold tty->link...

In the Linux kernel, the following vulnerability has been resolved:

serial: caif: hold tty->link reference in ldisc_open and ser_release

A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port.

Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path.

With this change applied, the reproducer no longer triggers the UAF in my testing.

Record: GHSA-27j8-6q5h-m6jx
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2026-43458 7.8

Record: BELL-CVE-2026-43458
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-43458 7.8

In the Linux kernel, the following vulnerability has been resolved: serial: caif: hold tty->link reference in ldisc_open and ser_release A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port. Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path. With this change applied, the reproducer no longer triggers the UAF in my testing.

Record: DEBIAN-CVE-2026-43458
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 40 moreShow less

OSVROOT-OS-DEBIAN-11-CVE-2026-43458 7.8

CVE-2026-43458 in linux - Patched by Root

Root has patched CVE-2026-43458 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2026-43458
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-43458 7.8

CVE-2026-43458 in linux - Patched by Root

Root has patched CVE-2026-43458 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-43458
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2026-43458 7.8

CVE-2026-43458 in linux - Patched by Root

Root has patched CVE-2026-43458 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-43458
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-43458 7.8

Record: UBUNTU-CVE-2026-43458
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-11

OSVCLSA-2026-1789373487 No score

Fix of 123 CVEs

CVE-2025-68214
- timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214}
CVE-2024-58093
- PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
CVE-2026-72463
- xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
CVE-2026-64600
- xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
CVE-2026-64095
- batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
CVE-2026-64274
- Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
CVE-2026-64273
- Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
CVE-2026-64270
- Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
CVE-2026-64188
- net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
CVE-2026-64096
- batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096}
CVE-2026-64093
- batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
CVE-2026-64091
- batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
CVE-2026-64298
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
CVE-2026-64276
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
CVE-2026-64271
- Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
CVE-2026-64266
- fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
CVE-2026-64218
- batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218}
CVE-2026-64191
- i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
CVE-2026-64115
- vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
CVE-2026-64114
- ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
CVE-2026-64113
- ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
CVE-2026-64103
- scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
CVE-2026-43249
- 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
CVE-2025-39686
- comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
CVE-2025-38068
- crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
CVE-2025-39901
- i40e: remove read access to debugfs files {CVE-2025-39901}
CVE-2023-54207
- HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
CVE-2023-53446
- PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
CVE-2022-50422
- scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
CVE-2022-50066
- net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
CVE-2025-71152
- net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152}
CVE-2026-53131
- netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
CVE-2026-31685
- netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
CVE-2026-31768
- iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
CVE-2026-43458
- serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
- serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
CVE-2023-53338
- lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
CVE-2026-43076…

Record: CLSA-2026-1789373487
Updated: 2026-11-02

OSVCLSA-2026-1789373515 No score

Fix of 124 CVEs

CVE-2025-68214
- timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214}
CVE-2024-58093
- PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
CVE-2026-72463
- xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
CVE-2026-64600
- xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
CVE-2026-64095
- batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
CVE-2026-64274
- Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
CVE-2026-64273
- Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
CVE-2026-64270
- Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
CVE-2026-64188
- net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
CVE-2026-64096
- batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096}
CVE-2026-64093
- batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
CVE-2026-64091
- batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
CVE-2026-64298
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
CVE-2026-64276
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
CVE-2026-64271
- Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
CVE-2026-64266
- fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
CVE-2026-64218
- batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218}
CVE-2026-64191
- i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
CVE-2026-64115
- vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
CVE-2026-64114
- ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
CVE-2026-64113
- ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
CVE-2026-64103
- scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
CVE-2026-43249
- 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
CVE-2025-39686
- comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
CVE-2025-38068
- crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
CVE-2025-39901
- i40e: remove read access to debugfs files {CVE-2025-39901}
CVE-2023-54207
- HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
CVE-2023-53446
- PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
CVE-2022-50422
- scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
CVE-2022-50066
- net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
CVE-2025-71152
- net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152}
CVE-2026-53131
- netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
CVE-2026-31685
- netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
CVE-2026-31768
- iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
CVE-2026-43458
- serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
- serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
CVE-2023-53338
- lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
CVE-2026-43076…

Record: CLSA-2026-1789373515
Updated: 2026-11-02

OSVCLSA-2026-1789460387 No score

Fix of 134 CVEs

CVE-2026-72463
- xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
CVE-2026-64600
- xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
CVE-2026-46175
- f2fs: fix fsck inconsistency caused by FGGC of node block {CVE-2026-46175}
CVE-2025-68254
- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing {CVE-2025-68254}
CVE-2025-68255
- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing {CVE-2025-68255}
CVE-2026-64268
- RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
CVE-2025-68286
- drm/amd/display: Check NULL before accessing {CVE-2025-68286}
CVE-2026-53024
- greybus: raw: fix use-after-free if write is called after disconnect {CVE-2026-53024}
CVE-2026-53025
- greybus: raw: fix use-after-free on cdev close {CVE-2026-53025}
CVE-2026-52934
- batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
CVE-2025-68303
- platform/x86: intel: punit_ipc: fix memory corruption {CVE-2025-68303}
CVE-2026-64280
- fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280}
CVE-2026-64188
- net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
CVE-2026-64109
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
CVE-2026-64274
- Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
CVE-2026-64270
- Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
CVE-2026-64093
- batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
CVE-2026-64091
- batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
CVE-2026-53329
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}
CVE-2026-64298
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
CVE-2026-64276
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
CVE-2026-64273
- Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
CVE-2026-64271
- Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
CVE-2026-64266
- fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
CVE-2026-64191
- i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
CVE-2026-64189
- netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
CVE-2026-31786
- Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
CVE-2025-68799
- caif: fix integer underflow in cffrml_receive() {CVE-2025-68799}
CVE-2025-68302
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() {CVE-2025-68302}
CVE-2025-40243
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() {CVE-2025-40243}
CVE-2025-40233
- ocfs2: clear extent cache after moving/defragmenting extents {CVE-2025-40233}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2026-43249
- 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
CVE-2026-31657
- batman-adv: hold claim backbone gateways by reference {CVE-2026-31657}
CVE-2026-31598
- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
CVE-2026-31768
- iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
CVE-2026-23216
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} *…

Record: CLSA-2026-1789460387
Updated: 2026-11-02

OSVCLSA-2026-1791185545 No score

Fix of 63 CVEs

CVE-2026-64375
- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
- exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2025-38068
- crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
CVE-2024-56570
- ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
CVE-2025-21753
- btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
CVE-2026-46116
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
CVE-2022-49811
- drbd: use after free in drbd_create_device() {CVE-2022-49811}
CVE-2022-49059
- nfc: nci: add flush_workqueue to prevent uaf {CVE-2022-49059}
CVE-2025-22004
- net: atm: fix use after free in lec_send() {CVE-2025-22004}
CVE-2025-21764
- ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
CVE-2025-21762
- arp: use RCU protection in arp_xmit() {CVE-2025-21762}
CVE-2026-52934
- batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
CVE-2026-46090
- ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090}
CVE-2026-53131
- netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
CVE-2026-53091
- net: pull headers in qdisc_pkt_len_init() {CVE-2026-53091}
CVE-2026-52986
- netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}
CVE-2025-71116
- libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
CVE-2026-43493
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
CVE-2026-31597
- ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
CVE-2026-43116
- netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
CVE-2026-43458
- serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
CVE-2026-53002
- netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
CVE-2026-46212
- batman-adv: bla: prevent use-after-free when deleting claims {CVE-2026-46212}
CVE-2026-31787
- xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
CVE-2023-53357
- md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
CVE-2026-43075
- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
CVE-2026-43076
- ocfs2: validate inline data i_size during inode read {CVE-2026-43076}
CVE-2025-38464
- tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2026-43279
- ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
CVE-2024-36013
- Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
CVE-2026-53228
- ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
CVE-2026-45970
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
CVE-2026-52920
- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
CVE-2026-46270
- power: supply: rt9455: Fix use-after-free in power_supply_changed() {CVE-2026-46270}
CVE-2026-46259
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
CVE-2026-52998
- netfilter: xt_osf: fix potential NULL…

Record: CLSA-2026-1791185545
Updated: 2026-11-02

OSV No score

serial: caif: hold tty->link reference in ldisc_open and ser_release

In the Linux kernel, the following vulnerability has been resolved:

serial: caif: hold tty->link reference in ldisc_open and ser_release

A reproducer triggers a KASAN slab-use-after-free in pty_write_room() when caif_serial's TX path calls tty_write_room(). The faulting access is on tty->link->port.

Hold an extra kref on tty->link for the lifetime of the caif_serial line discipline: get it in ldisc_open() and drop it in ser_release(), and also drop it on the ldisc_open() error path.

With this change applied, the reproducer no longer triggers the UAF in my testing.

Record: CVE-2026-43458
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21388-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: openSUSE-SU-2026:21388-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22742-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22742-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22769-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22769-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22812-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22812-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22835-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-10263: arm64: cputype: Add C1-Premium definitions (bsc#1266290).
CVE-2025-39894: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm (bsc#1262430).
CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
CVE-2026-23248: perf: Make perf_pmu_unregister() useable (bsc#1259800).
CVE-2026-23394: Revert: "af_unix: Remove lock dance in unix_peek_fds()." (bsc#1260565).
CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
CVE-2026-31438: netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (bsc#1267824).
CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
CVE-2026-31479: drm/xe: always keep track of remap prev/next (bsc#1262765).
CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
CVE-2026-31646: net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (bsc#1263796).
CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
CVE-2026-31743: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy (bsc#1264067).
CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated (bsc#1263934).
CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
CVE-2026-43035: net:…

Record: SUSE-SU-2026:22835-1
Updated: 2026-11-02

OSVUSN-8567-1 No score

linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)