CVE-2026-46323

In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.

The Linux Kernel, the operating system core itself.

Security Fix(es):

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.(CVE-2025-10263)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)

In smbd_destroy() we may destroy the memory so we better wait until post_send_credits_work is no longer pending and will never be started again.

I actually just hit the case using rxe:

WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe] ... [ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs] [ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs] [ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60 [ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs] [ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs] [ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs] [ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10 [ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0 [ 5305.687889] [ T138] process_one_work+0x629/0xf80 [ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687933] [ T138] worker_thread+0x87f/0x1570 ...

It means rxe_post_recv was called after rdma_destroy_qp(). This happened because put_receive_buffer() was triggered by ib_drain_qp() and called: queue_work(info->workqueue, &info->post_send_credits_work);(CVE-2025-39932)

In the Linux kernel, the following vulnerability has been resolved:

riscv: Sanitize syscall table indexing under speculation

The syscall number is a user-controlled value used to index into the syscall table. Use array_index_nospec() to clamp this value after the bounds check to prevent speculative out-of-bounds access and subsequent data leakage via cache side channels.(CVE-2025-71203)

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: release admin tagset if init fails

nvme_fabrics creates an NVMe/FC controller in following path:

nvmf_dev_write()
  -> nvmf_create_ctrl()
    -> nvme_fc_create_ctrl()
      -> nvme_fc_init_ctrl()

nvme_fc_init_ctrl() allocates the admin blk-mq resources right after nvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing the controller state, scheduling connect work, etc.), we jump to the fail_ctrl path, which tears down the controller references but never frees the admin queue/tag set. The leaked blk-mq allocations match the kmemleak report seen during blktests nvme/fc.

Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call nvme_remove_admin_tag_set() when it is set so that all admin queue allocations are reclaimed whenever controller setup aborts.(CVE-2026-23261)

In the Linux kernel, the following vulnerability has been resolved:

arm64: io: Extract user memory type in ioremap_prot()

The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' value determined from the user mapping of the target 'pfn' being accessed by the kernel. On arm64, the…

The Linux Kernel, the operating system core itself.

Security Fix(es):

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.(CVE-2025-10263)

In the Linux kernel, the following vulnerability has been resolved:

smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)

In smbd_destroy() we may destroy the memory so we better wait until post_send_credits_work is no longer pending and will never be started again.

I actually just hit the case using rxe:

WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe] ... [ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs] [ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs] [ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60 [ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs] [ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs] [ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs] [ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10 [ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0 [ 5305.687889] [ T138] process_one_work+0x629/0xf80 [ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687933] [ T138] worker_thread+0x87f/0x1570 ...

It means rxe_post_recv was called after rdma_destroy_qp(). This happened because put_receive_buffer() was triggered by ib_drain_qp() and called: queue_work(info->workqueue, &info->post_send_credits_work);(CVE-2025-39932)

In the Linux kernel, the following vulnerability has been resolved:

MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits

Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used, and this macro can generate more than 2 instructions. At the same time, the code in ftrace assumes that no more than 2 instructions can be generated, which is why it stores them in an int[2] array. However, as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA) causes a buffer overflow when _mcount is beyond 32 bits. This leads to corruption of the variables located in the __read_mostly section.

This corruption was observed because the variable __cpu_primary_thread_mask was corrupted, causing a hang very early during boot.

This fix prevents the corruption by avoiding the generation of instructions if they could exceed 2 instructions in length. Fortunately, insn_la_mcount is only used if the instrumented code is located outside the kernel code section, so dynamic ftrace can still be used, albeit in a more limited scope. This is still preferable to corrupting memory and/or crashing the kernel.(CVE-2025-71109)

In the Linux kernel, the following vulnerability has been resolved:

riscv: Sanitize syscall table indexing under speculation

The syscall number is a user-controlled value used to index into the syscall table. Use array_index_nospec() to clamp this value after the bounds check to prevent speculative out-of-bounds access and subsequent data leakage via cache side channels.(CVE-2025-71203)

In the Linux kernel, the following vulnerability has been resolved: …

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)

• kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)

• kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)

• kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

• kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)

• kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209)

• kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)

• kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)

• kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)

• kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263)

• kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)

Bug Fix(es) and Enhancement(s):

• WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau] [rhel-9.8.z] (JIRA:Rocky Linux-160966)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
• kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
• kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)
• kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
• kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227)
• kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209)
• kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
• kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244)
• kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)
• kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263)
• kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)

Bug Fix(es) and Enhancement(s):

• WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau] [almalinux-9.8.z] (JIRA:AlmaLinux-160966)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

net: gro: don't merge zcopy skbs

skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag.

When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF.

When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs.

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• ALSA: virtio: reset device before deleting virtqueues {CVE-2026-98264}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• ALSA: caiaq: Fix potential double-free at error path {CVE-2026-98066}
• ASoC: Intel: avs: Disable periods-elapsed work when closing PCM {CVE-2025-40344}
• ALSA: timer: drain a slave's callback before its master detaches it {CVE-2026-68201}
• ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams {CVE-2026-53242}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• security/keys: fix missed RCU read section on lookup {CVE-2026-64015}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518}
• rcu: Fix rcu_read_unlock() deadloop due to softirq {CVE-2026-45957}
• bpf: Fix potential UAF in bpf_netns_link_update_prog {CVE-2026-90393}
• bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
• scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847}
• scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue {CVE-2025-37861}
• scsi: csiostor: Fix dereference of null pointer rn {CVE-2026-45857}
• scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}
• wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
• wifi: mwifiex: validate scan response extents {CVE-2026-98185}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}
• net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830}
• net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list {CVE-2026-53230}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• veth: fix NAPI leak in XDP enable error path {CVE-2026-80613}
• RDMA/rxe: Fix double free in rxe_srq_from_init {CVE-2026-45852}
• RDMA/iwcm: Fix workqueue list corruption by removing work_list {CVE-2026-45898}
• ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
• svcrdma: Fix offset arithmetic in read_chunk_range {CVE-2026-89533}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• xprtrdma: Fix ep kref imbalance on ADDR_CHANGE {CVE-2026-72469}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• sctp: drop a chunk if its transport was removed {CVE-2026-89478}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• sctp: revalidate list cursor after…

These are all security issues fixed in the kernel-devel-7.0.12-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

Root has patched CVE-2026-46323 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-46323 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2026-46323 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.6.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.7.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.28.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.6.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.7.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.28.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags (bsc#1263108).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.4.0-31.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.4.0-33.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.4.0-29.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.4.0-30.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.4.0-31.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1260907).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.4.0-41.1 fixes various security issues

The following security issues were fixed:

• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).

This update for the SUSE Linux Enterprise Kernel 6.4.0-42.1 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261640).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263088).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263902).
• CVE-2026-43503: final dirty.frag related fixes (bsc#1266229).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46323: net: gro: don't merge zcopy skbs (bsc#1268282).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).
• net/sched: fix pedit partial COW leading to page cache (bsc#1267625).