CVE-2026-45856

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr).

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

iomap: Fix possible overflow condition in iomap_write_delalloc_scan

folio_next_index() returns an unsigned long value which left shifted by PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead use folio_pos(folio) + folio_size(folio), which does this correctly.(CVE-2023-54285)

In the Linux kernel, the following vulnerability has been resolved:

bcache: fix NULL pointer in cache_set_flush()

1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc().
2. LINE#2078 - LINE#2142 is some codes about function of register_cache_set().
3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098.

1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) 1795 { ... 1860 if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) || 1861 mempool_init_slab_pool(&c->search, 32, bch_search_cache) || 1862 mempool_init_kmalloc_pool(&c->bio_meta, 2, 1863 sizeof(struct bbio) + sizeof(struct bio_vec) * 1864 bucket_pages(c)) || 1865 mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) || 1866 bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio), 1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) || 1868 !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) || 1869 !(c->moving_gc_wq = alloc_workqueue("bcache_gc", 1870 WQ_MEM_RECLAIM, 0)) || 1871 bch_journal_alloc(c) || 1872 bch_btree_cache_alloc(c) || 1873 bch_open_buckets_alloc(c) || 1874 bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages))) 1875 goto err; ^^^^^^^^ 1876 ... 1883 return c; 1884 err: 1885 bch_cache_set_unregister(c); ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1886 return NULL; 1887 } ... 2078 static const char *register_cache_set(struct cache *ca) 2079 { ... 2098 c = bch_cache_set_alloc(&ca->sb); 2099 if (!c) 2100 return err; ^^^^^^^^^^ ... 2128 ca->set = c; 2129 ca->set->cache[ca->sb.nr_this_dev] = ca; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ... 2138 return NULL; 2139 err: 2140 bch_cache_set_unregister(c); 2141 return err; 2142 }

(1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and call bch_cache_set_unregister()(LINE#1885). (2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return. (3) As (2) has returned, LINE#2128 - LINE#2129 would do not give the value to c->cache[], it means that c->cache[] is NULL.

LINE#1624 - LINE#1665 is some codes about function of cache_set_flush(). As (1), in LINE#1885 call bch_cache_set_unregister() ---> bch_cache_set_stop() ---> closure_queue() -.-> cache_set_flush() (as below LINE#1624)

1624 static void cache_set_flush(struct closure *cl) 1625 { ... 1654 for_each_cache(ca, c, i) 1655 if (ca->alloc_thread) ^^ 1656 kthread_stop(ca->alloc_thread); ... 1665 }

(4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the kernel crash occurred as below: [ 846.712887] bcache: register_cache() error drbd6: cannot allocate memory [ 846.713242] bcache: register_bcache() error : failed to register device [ 846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered [ 846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8 [ 846.714790] PGD 0 P4D 0 [ 846.715129]…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

• kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)

Bug Fix(es) and Enhancement(s):

• Backport of protocol attribute to IP addresses (IFA_PROTO) [rhel-9.8.z] (JIRA:Rocky Linux-169936)

• try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [rhel-9.8.z] (JIRA:Rocky Linux-269060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)

• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

• kernel: gfs2: add some missing log locking (CVE-2026-53049)

• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)

• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

• Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)

• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

• kernel: gfs2: add some missing log locking (CVE-2026-53049)

• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)

• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

• Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-45856 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-45856 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-45856 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr).

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
• kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)

Bug Fix(es) and Enhancement(s):

• Backport of protocol attribute to IP addresses (IFA_PROTO) [almalinux-9.8.z] (JIRA:AlmaLinux-169936)
• try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [almalinux-9.8.z] (JIRA:AlmaLinux-269060)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)
• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
• kernel: gfs2: add some missing log locking (CVE-2026-53049)
• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)
• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)
• AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)
• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)
• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
• kernel: gfs2: add some missing log locking (CVE-2026-53049)
• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)
• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)
• AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)
• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)
• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
• kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)
• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
• kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)
• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
• kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
• kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
• kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
• kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
• kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918)
• kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)
• kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078)
• kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132)
• kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)
• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
• kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
• kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
• kernel: packet: use consistent hard_header_len in non-ring send paths ()
• kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
• kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
• kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
• kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

Bug Fix(es) and Enhancement(s):

• wifi card breaks using FIPS (JIRA:AlmaLinux-257457)
• AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds {CVE-2023-53582}
• net/sched: accept TCA_STAB only for root qdisc {CVE-2024-50039}
• bpf, sockmap: Several fixes to bpf_msg_pop_data {CVE-2024-56720}
• net: add more sanity checks to qdisc_pkt_len_init() {CVE-2024-49948}
• nvme-tcp: sanitize request list handling {CVE-2025-38264}
• smb: client: fix double free of TCP_Server_Info::hostname {CVE-2025-21673}
• net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
• net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• nfsd: never defer requests during idmap lookup {CVE-2026-45983}
• openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
• thermal: core: Fix thermal zone governor cleanup issues {CVE-2026-46021}
• tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
• Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• smb: client: fix krb5 mount with username option {CVE-2026-31392}
• netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212}
• USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
• crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
• fuse: reject fuse_notify() pagecache ops on directories {CVE-2026-53168}
• ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options {CVE-2026-53249}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• uio_hv_generic: Let userspace take care of interrupt mask {CVE-2025-40048}
• net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
• libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
• netfilter: nft_ct: fix missing expect put in obj eval {CVE-2026-52970}
• netfilter: nf_tables: always walk all pending catchall elements {CVE-2026-23278}
• crypto: af_alg - Cap AEAD AD length to 0x80000000 {CVE-2026-52972}
• wifi: cfg80211: advance loop vars in cfg80211_merge_profile() {CVE-2026-64174}
• NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr {CVE-2026-53391}
• Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock {CVE-2026-63945}
• pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
• RDMA/vmw_pvrdma: Fix…

• mac802154: llsec: reject frames shorter than the authentication tag {CVE-2026-68125}
• KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428}
• wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper {CVE-2026-68197}
• bpf: account for current allocated stack depth in widen_imprecise_scalars() {CVE-2025-68208}
• tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322}
• smb: client: fix potential cfid UAF in smb2_query_info_compound {CVE-2025-40320}
• net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• binfmt_misc: set have_execfd only once the interpreter is opened {CVE-2026-68186}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• tipc: fix u16 MTU truncation in media and bearer MTU validation {CVE-2026-68297}
• net: gro: fix double aggregation of flush-marked skbs {CVE-2026-68136}
• bpf, sockmap: Reject unhashed UDP sockets on sockmap update {CVE-2026-68386}
• wifi: brcmfmac: fix 802.1X-SHA256 call trace warning {CVE-2026-68304}
• udf: fix partition descriptor append bookkeeping {CVE-2026-45991}
• Bluetooth: SCO: fix race conditions in sco_sock_connect() {CVE-2026-43023}
• smb: client: validate dacloffset before building DACL pointers {CVE-2026-46195}
• smb/client: fix out-of-bounds read in symlink_data() {CVE-2026-46185}
• net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• RDMA/mana: Validate rx_hash_key_len {CVE-2026-46145}
• scsi: qla2xxx: Completely fix fcport double free {CVE-2026-43414}
• bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• wifi: mac80211: use safe list iteration in radar detect work {CVE-2026-46166}
• RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads {CVE-2026-46114}
• nfsd: never defer requests during idmap lookup {CVE-2026-45983}
• drop_monitor: fix size calculations for 64-bit attributes {CVE-2026-68287}
• openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
• dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
• netfilter: nft_inner: Fix IPv6 inner_thoff desync {CVE-2026-46244}
• drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() {CVE-2026-68429}
• crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
• RDMA/rxe: Fix race condition in QP timer handlers {CVE-2026-45910}
• wifi: mac80211: remove station if connection prep fails {CVE-2026-46125}
• tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
• scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk {CVE-2025-38289}
• net/sched: act_ct: Only release RCU read lock after ct_ft {CVE-2026-46319}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• io-wq: check that the predecessor is hashed in io_wq_remove_pending() {CVE-2026-46274}
• wifi: mac80211: drop stray 'static' from fast-RX rx_result {CVE-2026-46152}
• io_uring/poll: fix signed comparison in io_poll_get_ownership() {CVE-2026-52933}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• Bluetooth: btusb: validate Realtek vendor event length {CVE-2026-68339}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
• ipc: limit next_id…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• CVE-2025-39826
  • net: rose: convert 'use' field to refcount_t {CVE-2025-39826}
• CVE-2025-40146
  • blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
• CVE-2024-53216
  • nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
• CVE-2026-89778
  • isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• CVE-2026-23050
  • pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
• CVE-2025-68796
  • f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796}
• CVE-2025-68330
  • iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
• CVE-2025-40333
  • f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
• CVE-2025-40160
  • xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
• CVE-2023-54047
  • drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
• CVE-2025-68190
  • drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
• CVE-2025-68188
  • tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
• CVE-2026-89786
  • ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• CVE-2022-50764
  • ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
• CVE-2026-80785
  • fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
• CVE-2026-80788
  • nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788}
• CVE-2026-80747
  • drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}
• CVE-2026-80907
  • drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
• CVE-2026-80908
  • drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
• CVE-2026-80812
  • ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
• CVE-2026-80948
  • wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
• CVE-2025-40137
  • f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
• CVE-2023-54150
  • drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
• CVE-2026-89784
  • SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
• CVE-2026-89783
  • xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
• CVE-2026-89780
  • net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780}
• CVE-2026-89777
  • vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777}
• CVE-2026-89789
  • gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
• CVE-2025-68797
  • char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
• CVE-2025-68767
  • hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
• CVE-2026-63961
  • usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961}
• CVE-2026-63904
  • usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
• CVE-2022-50864
  • nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
• CVE-2025-68771
  • ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
• CVE-2025-68750
  • usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
• CVE-2026-80909
  • drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909}
• CVE-2026-74402
  • crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} *…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283}
• sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
• usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962}
• ice: fix double-free of tx_buf skb {CVE-2026-53009}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
• crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362}
• HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
• KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222}
• scsi: qla2xxx: Skip vport under deletion in report ID acquisition {CVE-2026-97531}
• dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343}
• tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
• libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
• libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• nvme: add missing SRCU grace period in error path {CVE-2026-89972}
• nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
• wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• fs/mbcache: cancel shrink work before destroying the…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• smb: client: harden POSIX SID length parsing {CVE-2026-64380}
• RDMA: Fix use-after-free in rxe_queue_cleanup {CVE-2021-47616}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047}
• tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
• net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• thunderbolt: Bound root directory content to block size {CVE-2026-53149}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006}
• ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002}
• Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697}
• HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}
• net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
• Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp {CVE-2026-53071}
• Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails {CVE-2026-53071}
• scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856}
• drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} -…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF {CVE-2026-98116}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• dm cache policy smq: check allocation under invalidate lock {CVE-2026-53265}
• RDMA/siw: Bound fragmented header copies by the remaining length {CVE-2026-98323}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• net: qrtr: ns: Fix use-after-free in driver remove() {CVE-2026-46047}
• RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043}
• gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984}
• gfs2: Add metapath_dibh helper {CVE-2026-45984}
• bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• gfs2: Fix slab-use-after-free in qd_put {CVE-2026-45861}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• sctp: purge outqueue on stale COOKIE-ECHO handling {CVE-2026-52924}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• wifi: nl80211: reject oversized EMA RNR lists {CVE-2026-53182}
• netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
• ppp: require CAP_NET_ADMIN in target…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero (bsc#1264091).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
• CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero (bsc#1264091).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
• CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
• CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
• CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31591: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (bsc#1263122).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info- leak (bsc#1264091).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
• CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31591: KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (bsc#1263122).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info- leak (bsc#1264091).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
• CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• RNBD block device driver;
• Ublk userspace block driver;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• MediaTek SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Realtek RTL8723BS SDIO drivers;
• UFS subsystem;
• ChipIdea USB driver;
• DesignWare USB3 driver;
• USB over IP driver;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• XFS file system;
• Audit subsystem;
• Memory Management;
• IPv6 networking;
• Netfilter;
• Tracing infrastructure;
• Kernel kexec() syscall;
• RCU subsystem;
• Scheduler infrastructure;
• Scatterlist API;
• 9P file system network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• KCM (Kernel Connection Multiplexor) sockets driver;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• RxRPC session sockets;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• X.25 network layer;
• XFRM subsystem;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SOF drivers;
• USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304, CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• RNBD block device driver;
• Ublk userspace block driver;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• MediaTek SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Realtek RTL8723BS SDIO drivers;
• UFS subsystem;
• ChipIdea USB driver;
• DesignWare USB3 driver;
• USB over IP driver;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• XFS file system;
• Audit subsystem;
• Memory Management;
• IPv6 networking;
• Netfilter;
• Tracing infrastructure;
• Kernel kexec() syscall;
• RCU subsystem;
• Scheduler infrastructure;
• Scatterlist API;
• 9P file system network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• KCM (Kernel Connection Multiplexor) sockets driver;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• RxRPC session sockets;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• X.25 network layer;
• XFRM subsystem;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SOF drivers;
• USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304, CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• RNBD block device driver;
• Ublk userspace block driver;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• MediaTek SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Realtek RTL8723BS SDIO drivers;
• UFS subsystem;
• ChipIdea USB driver;
• DesignWare USB3 driver;
• USB over IP driver;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• XFS file system;
• Audit subsystem;
• Memory Management;
• IPv6 networking;
• Netfilter;
• Tracing infrastructure;
• Kernel kexec() syscall;
• RCU subsystem;
• Scheduler infrastructure;
• Scatterlist API;
• 9P file system network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• KCM (Kernel Connection Multiplexor) sockets driver;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• RxRPC session sockets;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• X.25 network layer;
• XFRM subsystem;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SOF drivers;
• USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304, CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• RNBD block device driver;
• Ublk userspace block driver;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• MediaTek SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Realtek RTL8723BS SDIO drivers;
• UFS subsystem;
• ChipIdea USB driver;
• DesignWare USB3 driver;
• USB over IP driver;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• XFS file system;
• Audit subsystem;
• Memory Management;
• IPv6 networking;
• Netfilter;
• Tracing infrastructure;
• Kernel kexec() syscall;
• RCU subsystem;
• Scheduler infrastructure;
• Scatterlist API;
• 9P file system network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• KCM (Kernel Connection Multiplexor) sockets driver;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• RxRPC session sockets;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• X.25 network layer;
• XFRM subsystem;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SOF drivers;
• USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304, CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607,…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• RNBD block device driver;
• Ublk userspace block driver;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• MediaTek SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Realtek RTL8723BS SDIO drivers;
• UFS subsystem;
• ChipIdea USB driver;
• DesignWare USB3 driver;
• USB over IP driver;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• XFS file system;
• Audit subsystem;
• Memory Management;
• IPv6 networking;
• Netfilter;
• Tracing infrastructure;
• Kernel kexec() syscall;
• RCU subsystem;
• Scheduler infrastructure;
• Scatterlist API;
• 9P file system network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• KCM (Kernel Connection Multiplexor) sockets driver;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• RxRPC session sockets;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• X.25 network layer;
• XFRM subsystem;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SOF drivers;
• USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71233, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304, CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607,…

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local attacker could use this to cause memory corruption and, theoretically, arbitrary code execution. (CVE-2026-47331)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of fine- grained network socket mediation. (CVE-2026-47336)

Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local attacker could use this to cause a kernel oops. (CVE-2026-47337)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture; …

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• RNBD block device driver;
• Ublk userspace block driver;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• MediaTek SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Realtek RTL8723BS SDIO drivers;
• UFS subsystem;
• ChipIdea USB driver;
• DesignWare USB3 driver;
• USB over IP driver;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• BTRFS file system;
• File systems infrastructure;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• XFS file system;
• Audit subsystem;
• Memory Management;
• IPv6 networking;
• Netfilter;
• Tracing infrastructure;
• Kernel kexec() syscall;
• RCU subsystem;
• Scheduler infrastructure;
• Scatterlist API;
• 9P file system network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Ethernet bridge;
• Ceph Core library;
• Networking core;
• IPv4 networking;
• KCM (Kernel Connection Multiplexor) sockets driver;
• Multipath TCP;
• NFC subsystem;
• RDS protocol;
• RxRPC session sockets;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• X.25 network layer;
• XFRM subsystem;
• AppArmor security module;
• Simplified Mandatory Access Control Kernel framework;
• SOF drivers;
• USB sound devices; (CVE-2025-40005, CVE-2025-71229, CVE-2025-71231, CVE-2025-71232, CVE-2025-71235, CVE-2025-71236, CVE-2025-71237, CVE-2025-71238, CVE-2025-71239, CVE-2025-71265, CVE-2025-71266, CVE-2025-71267, CVE-2025-71272, CVE-2025-71273, CVE-2025-71274, CVE-2025-71286, CVE-2025-71291, CVE-2025-71292, CVE-2025-71294, CVE-2025-71295, CVE-2025-71297, CVE-2025-71304, CVE-2025-71305, CVE-2026-23100, CVE-2026-23169, CVE-2026-23220, CVE-2026-23221, CVE-2026-23222, CVE-2026-23228, CVE-2026-23229, CVE-2026-23230, CVE-2026-23233, CVE-2026-23234, CVE-2026-23235, CVE-2026-23236, CVE-2026-23237, CVE-2026-23238, CVE-2026-23241, CVE-2026-23242, CVE-2026-23243, CVE-2026-23249, CVE-2026-23266, CVE-2026-23267, CVE-2026-23272, CVE-2026-23278, CVE-2026-23392, CVE-2026-23428, CVE-2026-23450, CVE-2026-23455, CVE-2026-31402, CVE-2026-31411, CVE-2026-31418, CVE-2026-31436, CVE-2026-31448, CVE-2026-31478, CVE-2026-31607, CVE-2026-31637,…

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-31431)

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. (CVE-2026-43503, CVE-2026-46300)

Qualys discovered that a race condition existed in the ptrace subsystem of the Linux kernel when privileged processes are exiting. An unprivileged local attacker could use this issue to expose sensitive information. (CVE-2026-46333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a memory leak when handling AppArmor notifications. A local attacker could use this to cause resource exhaustion. (CVE-2026-47326)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contain a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel oops. (CVE-2026-47327)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an invalid free when handling AppArmor notifications. A local attacker could use this to corrupt kernel memory. (CVE-2026-47328)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained insufficient validation of AppArmor notification responses. A local attacker could use this to allow crafted responses to be processed. (CVE-2026-47329)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 used an uninitialized variable when handling AppArmor notifications. A local attacker could use this to cause incorrect caching of data. (CVE-2026-47330)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a use- after-free (UAF) bug. A local attacker could use this to cause memory corruption and, theoretically, arbitrary code execution. (CVE-2026-47331)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained an out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause information disclosure of kernel memory. (CVE-2026-47332)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a out-of-bounds (OOB) read when handling AppArmor notifications. A local attacker could use this to cause kernel memory corruption and, theoretically, influence processing of AppArmor policies. (CVE-2026-47333)

Tristan Madani discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained incorrect holding of locks when handling AppArmor notifications. A local attacker could use this to cause a kernel panic or deadlock. (CVE-2026-47334)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 contained a NULL pointer dereference when handling AppArmor notifications. A local attacker could use this to cause a kernel panic. (CVE-2026-47335)

Tristan Madani discovered that Ubuntu Linux kernel 6.8 used an uninitialized variable when handling AppArmor AF_INET/AF_INET6 socket mediation. A local attacker could use this to influence processing of fine- grained network socket mediation. (CVE-2026-47336)

Tristan Madani and Trevor Lawrence have each independently discovered that Ubuntu Linux kernel 6.8, 6.17 and 7.0 contained a NULL pointer dereference when handling AppArmor network socket mediation. A local attacker could use this to cause a…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…