CVE-2026-46056

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage in both handlers. Keep the existing keypress notification behavior unchanged by routing the early exits through a common unlock path.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix race between quota disable and quota rescan ioctl

There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree.

This happens as follows:

1. Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan();

2. Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A);

3. Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock;

4. Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free.

Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.(CVE-2025-39759)

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: avoid buffer overflow in WID string configuration

Fix the following copy overflow warning identified by Smatch checker.

drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame() error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)

This patch introduces size check before accessing the memory buffer. The checks are base on the WID type of received data from the firmware. For WID string configuration, the size limit is determined by individual element size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field of 'struct wilc_cfg_str'.(CVE-2025-39952)

In the Linux kernel, the following vulnerability has been resolved:

iio: accel: bmc150: Fix irq assumption regression

The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts:

Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read

PC is at bmc150_accel_set_interrupt+0x98/0x194 LR is at __pm_runtime_resume+0x5c/0x64 (...) Call trace: bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc __iio_update_buffers from enable_store+0x84/0xc8 enable_store from kernfs_fop_write_iter+0x154/0x1b4

This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why.

Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not.(CVE-2025-68330)

In the Linux kernel, the following vulnerability has been resolved:

staging: most: remove broken i2c driver

The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging.

Specifically, commit 723de0f9171e ("staging: most: remove device from interface structure") started requiring drivers to set the interface device pointer before registration, but the I2C driver was never updated which results in a NULL pointer dereference if anyone ever tries to probe it.(CVE-2025-68755)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix NULL dereference on root when tracing inode eviction

When evicting an inode the first thing we do is to setup tracing for it, which implies fetching the root's id. But in btrfs_evict_inode() the root might be NULL, as implied in the…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)

• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)

• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

• kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)

• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)

• kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)

• kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)

• kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)

• kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)

• kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)

• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

• kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

• kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

Bug Fix(es) and Enhancement(s):

• Rocky Linux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-10.2.z] (JIRA:Rocky Linux-166047)

• Rocky Linux9.5 crash due to lpfc NULL ndlp->vport [rhel-10.2.z] (JIRA:Rocky Linux-171774)

• objtool static_call check blocks build of out-of-tree livepatch modules on Rocky Linux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:Rocky Linux-178495)

• ibmveth Adapter Freeze with Small MSS [rhel-10.2.z] (JIRA:Rocky Linux-179723)

• rbd: eliminate a race in lock_dwork draining on unmap [rhel-10.2.z] (JIRA:Rocky Linux-183127)

• Rocky Linux10.0 - s390/mm: Add missing secure storage access fixups [rhel-10.2.z] (JIRA:Rocky Linux-183319)

• [Rocky Linux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:Rocky Linux-182299)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

• kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)

• kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)

• kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)

• kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)

• kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)

• kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)

• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

• kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

• kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)

• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

• kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

• kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

• kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

Bug Fix(es) and Enhancement(s):

• Rocky Linux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-9.8.z] (JIRA:Rocky Linux-166048)

• [Rocky Linux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [rhel-9.8.z] (JIRA:Rocky Linux-175699)

• DPLL: Add support for pin operational state [rhel-9.8.z] (JIRA:Rocky Linux-175820)

• DPLL: Add support for fractional frequency offset between pin and device [rhel-9.8.z] (JIRA:Rocky Linux-175823)

• ibmveth Adapter Freeze with Small MSS [rhel-9.8.z] (JIRA:Rocky Linux-178308)

• Rocky Linux9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.8.z] (JIRA:Rocky Linux-183317)

• rbd: eliminate a race in lock_dwork draining on unmap [rhel-9.8.z] (JIRA:Rocky Linux-183130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-46056 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-46056 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-46056 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-46056 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently. Extend the hci_dev_lock critical section to cover all conn usage in both handlers. Keep the existing keypress notification behavior unchanged by routing the early exits through a common unlock path.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
• kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
• kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
• kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
• kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
• kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
• kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
• kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
• kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

Bug Fix(es) and Enhancement(s):

• AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047)
• AlmaLinux9.5 crash due to lpfc NULL ndlp->vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774)
• objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495)
• ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723)
• rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127)
• AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319)
• [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
• kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
• kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
• kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
• kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414)
• kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
• kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
• kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
• kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
• kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
• kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)
• kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)

Bug Fix(es) and Enhancement(s):

• AlmaLinux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-9.8.z] (JIRA:AlmaLinux-166048)
• [AlmaLinux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [almalinux-9.8.z] (JIRA:AlmaLinux-175699)
• DPLL: Add support for pin operational state [almalinux-9.8.z] (JIRA:AlmaLinux-175820)
• DPLL: Add support for fractional frequency offset between pin and device [almalinux-9.8.z] (JIRA:AlmaLinux-175823)
• ibmveth Adapter Freeze with Small MSS [almalinux-9.8.z] (JIRA:AlmaLinux-178308)
• AlmaLinux9.4 - s390/mm: Add missing secure storage access fixups [almalinux-9.8.z] (JIRA:AlmaLinux-183317)
• rbd: eliminate a race in lock_dwork draining on unmap [almalinux-9.8.z] (JIRA:AlmaLinux-183130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

hci_conn lookup and field access must be covered by hdev lock in hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise the connection can be freed concurrently.

Extend the hci_dev_lock critical section to cover all conn usage in both handlers.

Keep the existing keypress notification behavior unchanged by routing the early exits through a common unlock path.

• wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds {CVE-2023-53582}
• net/sched: accept TCA_STAB only for root qdisc {CVE-2024-50039}
• bpf, sockmap: Several fixes to bpf_msg_pop_data {CVE-2024-56720}
• net: add more sanity checks to qdisc_pkt_len_init() {CVE-2024-49948}
• nvme-tcp: sanitize request list handling {CVE-2025-38264}
• smb: client: fix double free of TCP_Server_Info::hostname {CVE-2025-21673}
• net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
• net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• nfsd: never defer requests during idmap lookup {CVE-2026-45983}
• openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
• thermal: core: Fix thermal zone governor cleanup issues {CVE-2026-46021}
• tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
• Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• smb: client: fix krb5 mount with username option {CVE-2026-31392}
• netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212}
• USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
• crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
• fuse: reject fuse_notify() pagecache ops on directories {CVE-2026-53168}
• ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options {CVE-2026-53249}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• uio_hv_generic: Let userspace take care of interrupt mask {CVE-2025-40048}
• net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
• libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
• netfilter: nft_ct: fix missing expect put in obj eval {CVE-2026-52970}
• netfilter: nf_tables: always walk all pending catchall elements {CVE-2026-23278}
• crypto: af_alg - Cap AEAD AD length to 0x80000000 {CVE-2026-52972}
• wifi: cfg80211: advance loop vars in cfg80211_merge_profile() {CVE-2026-64174}
• NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr {CVE-2026-53391}
• Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock {CVE-2026-63945}
• pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
• RDMA/vmw_pvrdma: Fix…

• mac802154: llsec: reject frames shorter than the authentication tag {CVE-2026-68125}
• KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428}
• wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper {CVE-2026-68197}
• bpf: account for current allocated stack depth in widen_imprecise_scalars() {CVE-2025-68208}
• tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322}
• smb: client: fix potential cfid UAF in smb2_query_info_compound {CVE-2025-40320}
• net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• binfmt_misc: set have_execfd only once the interpreter is opened {CVE-2026-68186}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• tipc: fix u16 MTU truncation in media and bearer MTU validation {CVE-2026-68297}
• net: gro: fix double aggregation of flush-marked skbs {CVE-2026-68136}
• bpf, sockmap: Reject unhashed UDP sockets on sockmap update {CVE-2026-68386}
• wifi: brcmfmac: fix 802.1X-SHA256 call trace warning {CVE-2026-68304}
• udf: fix partition descriptor append bookkeeping {CVE-2026-45991}
• Bluetooth: SCO: fix race conditions in sco_sock_connect() {CVE-2026-43023}
• smb: client: validate dacloffset before building DACL pointers {CVE-2026-46195}
• smb/client: fix out-of-bounds read in symlink_data() {CVE-2026-46185}
• net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• RDMA/mana: Validate rx_hash_key_len {CVE-2026-46145}
• scsi: qla2xxx: Completely fix fcport double free {CVE-2026-43414}
• bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• wifi: mac80211: use safe list iteration in radar detect work {CVE-2026-46166}
• RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads {CVE-2026-46114}
• nfsd: never defer requests during idmap lookup {CVE-2026-45983}
• drop_monitor: fix size calculations for 64-bit attributes {CVE-2026-68287}
• openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
• dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
• netfilter: nft_inner: Fix IPv6 inner_thoff desync {CVE-2026-46244}
• drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() {CVE-2026-68429}
• crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
• RDMA/rxe: Fix race condition in QP timer handlers {CVE-2026-45910}
• wifi: mac80211: remove station if connection prep fails {CVE-2026-46125}
• tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
• scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk {CVE-2025-38289}
• net/sched: act_ct: Only release RCU read lock after ct_ft {CVE-2026-46319}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• io-wq: check that the predecessor is hashed in io_wq_remove_pending() {CVE-2026-46274}
• wifi: mac80211: drop stray 'static' from fast-RX rx_result {CVE-2026-46152}
• io_uring/poll: fix signed comparison in io_poll_get_ownership() {CVE-2026-52933}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• Bluetooth: btusb: validate Realtek vendor event length {CVE-2026-68339}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
• ipc: limit next_id…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• CVE-2025-68214
  • timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214}
• CVE-2024-58093
  • PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-64095
  • batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64096
  • batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64218
  • batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64115
  • vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• CVE-2026-64114
  • ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• CVE-2026-64113
  • ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• CVE-2026-64103
  • scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2025-39686
  • comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
• CVE-2025-38068
  • crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• CVE-2025-39901
  • i40e: remove read access to debugfs files {CVE-2025-39901}
• CVE-2023-54207
  • HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
• CVE-2023-53446
  • PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2025-71152
  • net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152}
• CVE-2026-53131
  • netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• CVE-2026-31685
  • netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-43458
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
• CVE-2023-53338
  • lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• CVE-2026-43076…

• CVE-2025-68214
  • timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214}
• CVE-2024-58093
  • PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-64095
  • batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64096
  • batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64218
  • batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64115
  • vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• CVE-2026-64114
  • ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• CVE-2026-64113
  • ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• CVE-2026-64103
  • scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2025-39686
  • comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
• CVE-2025-38068
  • crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• CVE-2025-39901
  • i40e: remove read access to debugfs files {CVE-2025-39901}
• CVE-2023-54207
  • HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
• CVE-2023-53446
  • PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2025-71152
  • net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152}
• CVE-2026-53131
  • netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• CVE-2026-31685
  • netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-43458
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
• CVE-2023-53338
  • lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• CVE-2026-43076…

• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-46175
  • f2fs: fix fsck inconsistency caused by FGGC of node block {CVE-2026-46175}
• CVE-2025-68254
  • staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing {CVE-2025-68254}
• CVE-2025-68255
  • staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing {CVE-2025-68255}
• CVE-2026-64268
  • RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• CVE-2025-68286
  • drm/amd/display: Check NULL before accessing {CVE-2025-68286}
• CVE-2026-53024
  • greybus: raw: fix use-after-free if write is called after disconnect {CVE-2026-53024}
• CVE-2026-53025
  • greybus: raw: fix use-after-free on cdev close {CVE-2026-53025}
• CVE-2026-52934
  • batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
• CVE-2025-68303
  • platform/x86: intel: punit_ipc: fix memory corruption {CVE-2025-68303}
• CVE-2026-64280
  • fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64109
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-53329
  • drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64189
  • netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• CVE-2026-31786
  • Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
• CVE-2025-68799
  • caif: fix integer underflow in cffrml_receive() {CVE-2025-68799}
• CVE-2025-68302
  • net: sxgbe: fix potential NULL dereference in sxgbe_rx() {CVE-2025-68302}
• CVE-2025-40243
  • hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() {CVE-2025-40243}
• CVE-2025-40233
  • ocfs2: clear extent cache after moving/defragmenting extents {CVE-2025-40233}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2026-31657
  • batman-adv: hold claim backbone gateways by reference {CVE-2026-31657}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-23216
  • scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} *…

• CVE-2024-36894
  • usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
• CVE-2026-97447
  • ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
• CVE-2026-93822
  • PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
• CVE-2026-93826
  • HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• CVE-2026-97954
  • net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
• CVE-2026-97949
  • configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• CVE-2026-97931
  • ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• CVE-2026-97940
  • ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• CVE-2026-97539
  • usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• CVE-2026-74510
  • Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• CVE-2026-72084
  • scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-90321
  • ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-74637
  • perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• CVE-2026-74752
  • sctp: validate cookie AUTH state before use {CVE-2026-74752}
• CVE-2026-74387
  • ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• CVE-2026-80536
  • xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• CVE-2026-89659
  • NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• CVE-2026-80576
  • drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• CVE-2026-90223
  • nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
• CVE-2026-80994
  • net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• CVE-2026-72398
  • sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• CVE-2026-74583
  • net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• CVE-2026-72322
  • ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• CVE-2026-93095
  • hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
• CVE-2026-72472
  • nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-90421
  • PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• CVE-2026-64583
  • usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
• CVE-2026-68329
  • iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
• CVE-2026-89448
  • iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• CVE-2026-64001
  • ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
• CVE-2026-64305
  • crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• CVE-2026-64348
  • usb: free iso schedules on failed submit {CVE-2026-64348}
• CVE-2026-64422
  • net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• CVE-2026-90180
  • block:…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283}
• sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
• usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962}
• ice: fix double-free of tx_buf skb {CVE-2026-53009}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
• crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362}
• HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
• KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222}
• scsi: qla2xxx: Skip vport under deletion in report ID acquisition {CVE-2026-97531}
• dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343}
• tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
• libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
• libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• nvme: add missing SRCU grace period in error path {CVE-2026-89972}
• nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
• wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• fs/mbcache: cancel shrink work before destroying the…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• smb: client: harden POSIX SID length parsing {CVE-2026-64380}
• RDMA: Fix use-after-free in rxe_queue_cleanup {CVE-2021-47616}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047}
• tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
• net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• thunderbolt: Bound root directory content to block size {CVE-2026-53149}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006}
• ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002}
• Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697}
• HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}
• net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
• Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp {CVE-2026-53071}
• Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails {CVE-2026-53071}
• scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856}
• drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} -…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF {CVE-2026-98116}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• dm cache policy smq: check allocation under invalidate lock {CVE-2026-53265}
• RDMA/siw: Bound fragmented header copies by the remaining length {CVE-2026-98323}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• net: qrtr: ns: Fix use-after-free in driver remove() {CVE-2026-46047}
• RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043}
• gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984}
• gfs2: Add metapath_dibh helper {CVE-2026-45984}
• bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• gfs2: Fix slab-use-after-free in qd_put {CVE-2026-45861}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• sctp: purge outqueue on stale COOKIE-ECHO handling {CVE-2026-52924}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• wifi: nl80211: reject oversized EMA RNR lists {CVE-2026-53182}
• netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
• ppp: require CAP_NET_ADMIN in target…

These are all security issues fixed in the kernel-devel-7.0.11-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify: fix…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify:…