CVE-2026-46043

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size() underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix race between quota disable and quota rescan ioctl

There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree.

This happens as follows:

1. Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan();

2. Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A);

3. Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock;

4. Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free.

Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.(CVE-2025-39759)

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: avoid buffer overflow in WID string configuration

Fix the following copy overflow warning identified by Smatch checker.

drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame() error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)

This patch introduces size check before accessing the memory buffer. The checks are base on the WID type of received data from the firmware. For WID string configuration, the size limit is determined by individual element size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field of 'struct wilc_cfg_str'.(CVE-2025-39952)

In the Linux kernel, the following vulnerability has been resolved:

iio: accel: bmc150: Fix irq assumption regression

The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts:

Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read

PC is at bmc150_accel_set_interrupt+0x98/0x194 LR is at __pm_runtime_resume+0x5c/0x64 (...) Call trace: bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc __iio_update_buffers from enable_store+0x84/0xc8 enable_store from kernfs_fop_write_iter+0x154/0x1b4

This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why.

Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not.(CVE-2025-68330)

In the Linux kernel, the following vulnerability has been resolved:

staging: most: remove broken i2c driver

The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging.

Specifically, commit 723de0f9171e ("staging: most: remove device from interface structure") started requiring drivers to set the interface device pointer before registration, but the I2C driver was never updated which results in a NULL pointer dereference if anyone ever tries to probe it.(CVE-2025-68755)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix NULL dereference on root when tracing inode eviction

When evicting an inode the first thing we do is to setup tracing for it, which implies fetching the root's id. But in btrfs_evict_inode() the root might be NULL, as implied in the…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)

• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

• kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)

• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

• kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)

• kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)

• kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

• kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)

• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

• kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

• kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)

• kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

• kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)

• kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)

• kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)

• kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)

• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

• kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)

• kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)

• kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)

• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)

• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

• kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)

• kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

• kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)

• kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

Bug Fix(es) and Enhancement(s):

• gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:Rocky Linux-252540)

• The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z] (JIRA:Rocky Linux-252544)

• gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:Rocky Linux-253986)

• [Rocky Linux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255217)

• [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z] (JIRA:Rocky Linux-256733)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

• kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120)

• kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)

• kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)

• kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)

• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

• kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

• kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

• kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

• kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

• kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

Bug Fix(es) and Enhancement(s):

• Intel IOMMU: possible circular locking dependency (JIRA:Rocky Linux-243217)

• xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:Rocky Linux-251578)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)

• kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120)

• kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)

• kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)

• kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)

• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)

• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

• kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)

• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)

• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)

• kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)

• kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)

• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)

• kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)

• kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)

• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)

• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

Bug Fix(es) and Enhancement(s):

• Intel IOMMU: possible circular locking dependency (JIRA:Rocky Linux-243217)

• xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:Rocky Linux-251578)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-46043 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-46043 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-46043 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-46043 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used. However, payload_size() subtracts both the attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen: payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE This means a short packet can still make payload_size() underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave payload_size() negative and pass an underflowed value to later receive-path users. Fix this by validating pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
• kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
• kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
• kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)
• kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
• kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)
• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
• kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
• kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)
• kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
• kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
• kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)
• kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)
• kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)
• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
• kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)
• kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)
• kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)
• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
• kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)
• kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)
• kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)
• kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

Bug Fix(es) and Enhancement(s):

• gfs2: filesystem withdrawal rework [almalinux-9.8.z] (JIRA:AlmaLinux-252540)
• The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [almalinux-9.8.z] (JIRA:AlmaLinux-252544)
• gfs2: Get rid of sd_async_glock_wait [almalinux-9.8.z] (JIRA:AlmaLinux-253986)
• [AlmaLinux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255217)
• [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [almalinux-9.8.z] (JIRA:AlmaLinux-256733)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
• kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120)
• kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)
• kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)
• kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)
• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
• kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
• kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
• kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
• kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
• kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

Bug Fix(es) and Enhancement(s):

• Intel IOMMU: possible circular locking dependency (JIRA:AlmaLinux-243217)
• xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:AlmaLinux-251578)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964)
• kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread (CVE-2023-54120)
• kernel: Bluetooth: L2CAP: Fix potential user-after-free (CVE-2023-54214)
• kernel: Bluetooth: btusb: revert use of devm_kzalloc in btusb (CVE-2025-71082)
• kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334)
• kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894)
• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
• kernel: Bluetooth: serialize accept_q access (CVE-2026-52918)
• kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062)
• kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053)
• kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256)
• kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254)
• kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823)
• kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975)
• kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947)
• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
• kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293)
• kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188)

Bug Fix(es) and Enhancement(s):

• Intel IOMMU: possible circular locking dependency (JIRA:AlmaLinux-243217)
• xfs: repeated xfs_trans_cancel called from xfs_iomap_write_direct (JIRA:AlmaLinux-251578)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used.

However, payload_size() subtracts both the attacker-controlled BTH pad field and RXE_ICRC_SIZE from pkt->paylen:

payload_size = pkt->paylen - offset[RXE_PAYLOAD] - bth_pad(pkt) - RXE_ICRC_SIZE

This means a short packet can still make payload_size() underflow even if it includes enough bytes for the fixed headers. Simply requiring header_size(pkt) + RXE_ICRC_SIZE is not sufficient either, because a packet with a forged non-zero BTH pad can still leave payload_size() negative and pass an underflowed value to later receive-path users.

Fix this by validating pkt->paylen against the full minimum length required by payload_size(): header_size(pkt) + bth_pad(pkt) + RXE_ICRC_SIZE.

• Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek
• sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison {CVE-2026-53309}
• ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043}
• ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
• wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
• drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• mm:…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-46175
  • f2fs: fix fsck inconsistency caused by FGGC of node block {CVE-2026-46175}
• CVE-2025-68254
  • staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing {CVE-2025-68254}
• CVE-2025-68255
  • staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing {CVE-2025-68255}
• CVE-2026-64268
  • RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• CVE-2025-68286
  • drm/amd/display: Check NULL before accessing {CVE-2025-68286}
• CVE-2026-53024
  • greybus: raw: fix use-after-free if write is called after disconnect {CVE-2026-53024}
• CVE-2026-53025
  • greybus: raw: fix use-after-free on cdev close {CVE-2026-53025}
• CVE-2026-52934
  • batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
• CVE-2025-68303
  • platform/x86: intel: punit_ipc: fix memory corruption {CVE-2025-68303}
• CVE-2026-64280
  • fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64109
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-53329
  • drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64189
  • netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• CVE-2026-31786
  • Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
• CVE-2025-68799
  • caif: fix integer underflow in cffrml_receive() {CVE-2025-68799}
• CVE-2025-68302
  • net: sxgbe: fix potential NULL dereference in sxgbe_rx() {CVE-2025-68302}
• CVE-2025-40243
  • hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() {CVE-2025-40243}
• CVE-2025-40233
  • ocfs2: clear extent cache after moving/defragmenting extents {CVE-2025-40233}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2026-31657
  • batman-adv: hold claim backbone gateways by reference {CVE-2026-31657}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-23216
  • scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} *…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283}
• sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
• usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962}
• ice: fix double-free of tx_buf skb {CVE-2026-53009}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
• crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362}
• HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
• KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222}
• scsi: qla2xxx: Skip vport under deletion in report ID acquisition {CVE-2026-97531}
• dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343}
• tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
• libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
• libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• nvme: add missing SRCU grace period in error path {CVE-2026-89972}
• nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
• wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• fs/mbcache: cancel shrink work before destroying the…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• smb: client: harden POSIX SID length parsing {CVE-2026-64380}
• RDMA: Fix use-after-free in rxe_queue_cleanup {CVE-2021-47616}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047}
• tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
• net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• thunderbolt: Bound root directory content to block size {CVE-2026-53149}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006}
• ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002}
• Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697}
• HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}
• net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
• Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp {CVE-2026-53071}
• Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails {CVE-2026-53071}
• scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856}
• drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} -…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF {CVE-2026-98116}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• dm cache policy smq: check allocation under invalidate lock {CVE-2026-53265}
• RDMA/siw: Bound fragmented header copies by the remaining length {CVE-2026-98323}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• net: qrtr: ns: Fix use-after-free in driver remove() {CVE-2026-46047}
• RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043}
• gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984}
• gfs2: Add metapath_dibh helper {CVE-2026-45984}
• bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• gfs2: Fix slab-use-after-free in qd_put {CVE-2026-45861}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• sctp: purge outqueue on stale COOKIE-ECHO handling {CVE-2026-52924}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• wifi: nl80211: reject oversized EMA RNR lists {CVE-2026-53182}
• netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
• ppp: require CAP_NET_ADMIN in target…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of share_conf in compound request smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without validating tcon->t_state.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation().

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf.

In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers.

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container.)(CVE-2026-31431)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 'ksmbd: add support for read compound'), response buffer management was changed to use dynamic iov array.

In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc.

In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded.

In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer.

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry.

In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error).

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb.

In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...).

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide…

These are all security issues fixed in the kernel-devel-7.0.11-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero (bsc#1264091).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
• CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-23254: net: gro: fix outer network offset (bsc#1259884).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (bsc#1260548).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31401: HID: bpf: prevent buffer overflow in hid_hw_request (bsc#1261603).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31556: xfs: scrub: unlock dquot before early return in quota scrub (bsc#1263062).
• CVE-2026-31562: drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (bsc#1263058).
• CVE-2026-31584: media: mediatek: vcodec: fix use-after-free in encoder release path (bsc#1263180).
• CVE-2026-31645: net: lan966x: fix page pool leak in error paths (bsc#1263794).
• CVE-2026-31648: mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (bsc#1263579).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31683: batman-adv: avoid OGM aggregation when skb tailroom is insufficient (bsc#1263594).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31774: io_uring/net: fix slab-out-of-bounds read in io_bundle_nbufs() (bsc#1264040).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak (bsc#1264091).
• CVE-2026-43063: xfs: don't irele after failing to iget in xfs_attri_recover_work (bsc#1264196).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43150: perf/arm-cmn: Reject unsupported hardware configurations (bsc#1264415).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43197: netconsole: avoid OOB reads, msg is not nul-terminated (bsc#1264609).
• CVE-2026-43332: thermal: core: Fix thermal zone device registration error path (bsc#1265114).
• CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (bsc#1264723).
• CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() (bsc#1265081).
• CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() (bsc#1264672).
• CVE-2026-43455: net: mctp: Ensure keys maintain only one ref to corresponding dev (bsc#1264765).
• CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array (bsc#1266400).
• CVE-2026-45846: bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() (bsc#1266394).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-3150: bcache: fix cached_dev.sb_bio use-after-free and crash (bsc#1263169).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock (bsc#1263143).
• CVE-2026-31678: openvswitch: defer tunnel netdev_put to RCU release (bsc#1263562).
• CVE-2026-31703: writeback: Fix use after free in inode_switch_wbs_work_fn() (bsc#1263883).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-31767: drm/i915/dsi: Don't do DSC horizontal timing adjustments in command mode (bsc#1264124).
• CVE-2026-43013: net/mlx5: lag: Check for LAG device before creating debugfs (bsc#1264011).
• CVE-2026-43026: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (bsc#1263932).
• CVE-2026-43030: bpf: Fix regsafe() for pointers to packet (bsc#1264000).
• CVE-2026-43040: net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero (bsc#1264091).
• CVE-2026-43052: wifi: mac80211: check tdls flag in ieee80211_tdls_oper (bsc#1263945).
• CVE-2026-43054: scsi: target: tcm_loop: Drain commands in target_reset handler (bsc#1264063).
• CVE-2026-43059: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (bsc#1264184).
• CVE-2026-43065: ext4: always drain queued discard work in ext4_mb_release() (bsc#1264243).
• CVE-2026-43066: ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths (bsc#1264245).
• CVE-2026-43068: ext4: avoid…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
• CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock…

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-10263: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1266290).
• CVE-2025-38549: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths (bsc#1248235).
• CVE-2025-68324: scsi: imm: Fix use-after-free bug caused by unfinished delayed work (bsc#1255416).
• CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
• CVE-2026-23303: smb: client: Don't log plaintext credentials in cifs_set_cifscreds (bsc#1260502).
• CVE-2026-23327: cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
• CVE-2026-23359: bpf: Fix stack-out-of-bounds write in devmap (bsc#1260584).
• CVE-2026-23438: net: mvpp2: guard flow control update with global_tx_fc in buffer switching (bsc#1261619).
• CVE-2026-23444: wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (bsc#1266307).
• CVE-2026-31396: net: macb: fix use-after-free access to PTP clock (bsc#1261791).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31446: ext4: fix use-after-free in update_super_work when racing with umount (bsc#1262619).
• CVE-2026-31448: ext4: avoid infinite loops caused by residual data (bsc#1262622).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks (bsc#1262624).
• CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount (bsc#1262615).
• CVE-2026-31464: scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (bsc#1262656).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31480: tracing: Fix potential deadlock in cpu hotplug with osnoise (bsc#1262634).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31493: RDMA/efa: Fix use of completion ctx after free (bsc#1262668).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31500: Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (bsc#1262993).
• CVE-2026-31516: xfrm: prevent policy_hthresh.work from racing with netns teardown (bsc#1262755).
• CVE-2026-31518: esp: fix skb leak with espintcp and async crypto (bsc#1262606).
• CVE-2026-31546: net: bonding: fix NULL deref in bond_debug_rlb_hash_show (bsc#1263006).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31590: KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (bsc#1263152).
• CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
• CVE-2026-31596: ocfs2: handle invalid dinode in ocfs2_group_extend (bsc#1263319).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31655: pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (bsc#1263724).
• CVE-2026-31664: string.h: Introduce memset_after() for wiping trailing members/padding (bsc#1263578).
• CVE-2026-31665: kABI: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31671: xfrm_user: fix info leak in build_report() (bsc#1263115).
• CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock…

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
• CVE-2026-31473: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (bsc#1262663).
• CVE-2026-31613: smb: client: fix OOB reads parsing symlink error response (bsc#1263769).
• CVE-2026-31614: smb: client: fix off-by-8 bounds check in check_wsl_eas() (bsc#1263774).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).
• CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() (bsc#1264989).
• CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).
• CVE-2026-43503: net: skbuff: propagate shared-frag marker through frag-transfer helpers (bsc#1265960).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
• CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers (bsc#1266889).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
• CVE-2026-46004: ALSA: caiaq: Handle probe errors properly (bsc#1267222).
• CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
• CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
• CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).
• CVE-2026-46114: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (bsc#1266972).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).

The following non security issues were fixed:

• arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
• arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).
• drm/hyperv: validate resolution_count and fix WIN8 fallback (git-fixes).
• drm/hyperv: validate VMBus packet size in receive callback (git-fixes).
• net: gro: don't merge zcopy skbs (git-fixes).
• net: mana: Add NULL guards in teardown path to prevent panic on attach failure (git-fixes).
• net: mana: Expose hardware diagnostic info via debugfs (bsc#1266414).
• net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (bsc#1265928).
• net: mana: hardening: Reject zero max_num_queues from GDMA_QUERY_MAX_RESOURCES (git-fixes).
• net: mana: Skip redundant detach on already-detached port (git-fixes).
• net: mana: Use kvmalloc for large RX queue and buffer allocations (bsc#1266765).
• net: mana: Use per-queue allocation for tx_qp to reduce allocation size (bsc#1266765).
• net: mana: validate rx_req_idx to prevent out-of-bounds array access (bsc#1266402).
• RDMA/mana_ib: Report max_msg_sz in mana_ib_query_port (git-fixes).
• s390/barrier: Make array_index_mask_nospec() __always_inline (bsc#1263068).
• s390/entry: Scrub r12 register on kernel entry (bsc#1263068).
• s390/syscalls: Add spectre boundary for syscall dispatch table (bsc#1263068).
• smb: client: correctly handle ErrorContextData as a flexible array (git-fixes).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).
• CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
• CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
• CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
• CVE-2026-46113: KVM: x86/mmu: Add helper to convert SPTE value to its shadow page (bsc#1266969).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).

The following non security issues were fixed:

• arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
• arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).
• CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
• CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-31405: media: dvb-net: fix OOB access in ULE extension header tables (bsc#1261700).
• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-31758: usb: usbtmc: Flush anchored URBs in usbtmc_release (bsc#1264093).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).
• CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
• CVE-2026-45970: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (bsc#1267205).
• CVE-2026-46021: thermal: core: Fix thermal zone governor cleanup issues (bsc#1267220).
• CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
• CVE-2026-46113: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (bsc#1266969).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (bsc#1266238).

The following non security issues were fixed:

• arm64: tlb: Allow XZR argument to TLBI ops (git-fixes).
• arm64: tlb: Optimize ARM64_WORKAROUND_REPEAT_TLBI (git-fixes).

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-31629: nfc: llcp: add missing return after LLCP_CLOSED checks (bsc#1263790).
• CVE-2026-43037: ip6_tunnel: clear skb2->cb in ip4ip6_err() (bsc#1263995).
• CVE-2026-43206: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (bsc#1264551).
• CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter() (bsc#1266001).
• CVE-2026-43501: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (bsc#1266009).
• CVE-2026-45852: RDMA/rxe: Fix double free in rxe_srq_from_init (bsc#1266711).
• CVE-2026-46043: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (bsc#1266901).
• CVE-2026-46243: smb: client: reject userspace cifs.spnego descriptions (CIFSwitch) (bsc#1266238).