CVE-2026-52942

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log. This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed). Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before. BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) nf_hook_slow (net/netfilter/core.c:619) nf_hook_direct_egress (net/packet/af_packet.c:257) packet_xmit (net/packet/af_packet.c:280) packet_sendmsg (net/packet/af_packet.c:3114) __sys_sendto (net/socket.c:2265)

The Linux Kernel, the operating system core itself.

Security Fix(es):

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.(CVE-2025-10263)

In the Linux kernel, the following vulnerability has been resolved:

inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous.

socket(AF_INET, SOCK_RAW, 255);

A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes.

inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST") pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner

"man 7 raw" states:

A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets.

Make sure we drop these malicious packets.(CVE-2026-46266)

In the Linux kernel, the following vulnerability has been resolved:

tun: free page on build_skb failure in tun_xdp_one()

When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page. Each build_skb() failure in a batch leaks one page-frag chunk.

Free the page before taking the error path, matching the put_page() the other error exits of tun_xdp_one() already perform.(CVE-2026-46322)

In the Linux kernel, the following vulnerability has been resolved:

ip6_vti: set netns_immutable on the fallback device.

john1988 and Noam Rathaus reported that vti6_init_net() does not set the netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0).

Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel) correctly set this flag during their fallback device initialization to prevent them from being moved to another network namespace.(CVE-2026-52909)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_queue: hold bridge skb->dev while queued

br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjection.

When the verdict is reinjected later, br_netif_receive_skb() re-enters the receive path with skb->dev still pointing at the freed bridge master, triggering a use-after-free.

Store skb->dev in the queue entry, hold a reference on it for the queue lifetime, and use the saved device when dropping queued packets during NETDEV_DOWN handling.(CVE-2026-52912)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_hbh: reject oversized option lists

struct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors, but hbh_mt6_check() does not reject larger optsnr values supplied from userspace.

Validate optsnr in the rule setup path so only match data that fits the fixed-size opts array can be installed. This follows the existing xtables pattern of rejecting invalid user-provided counts in checkentry() and keeps the packet matching path unchanged.

struct ip6t_opts has a fixed opts[IP6T_OPTS_OPTSNR] array, where IP6T_OPTS_OPTSNR is 16, then off-by-one array access is possible:

[ 137.924693][ T8692] UBSAN:…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTO_RAW (255) was dangerous.

socket(AF_INET, SOCK_RAW, 255);

A malicious incoming ICMP packet can set the protocol field to 255 and match this socket, leading to FNHE cache changes.

inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST") pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner

"man 7 raw" states:

A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able to send any IP protocol that is specified in the passed header. Receiving of all IP protocols via IPPROTO_RAW is not possible using raw sockets.

Make sure we drop these malicious packets.(CVE-2026-46266)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_policy: fix strict mode inbound policy matching

match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout.

Derive the strict-match policy position from the number of transforms already consumed so that multi-element inbound rules are matched consistently.(CVE-2026-52920)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_log: validate MAC header was set before dumping it

The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log.

This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed).

Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before.

BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) nf_hook_slow (net/netfilter/core.c:619) nf_hook_direct_egress (net/packet/af_packet.c:257) packet_xmit (net/packet/af_packet.c:280) packet_sendmsg (net/packet/af_packet.c:3114) __sys_sendto (net/socket.c:2265)(CVE-2026-52942)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/srp: bound SRP_RSP sense copy by the received length

srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded.

A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)

• kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

• kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)

• kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

• kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

• kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)

• kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

• kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

• kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

• kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

• kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

• kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)

• kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

• kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

• kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

Bug Fix(es) and Enhancement(s):

• scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers [rhel 8.6.z] (JIRA:Rocky Linux-194117)

• gfs2: harden gfs2_glock_hold [Rocky Linux-8] (JIRA:Rocky Linux-240340)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)

• kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

• kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)

• kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

• kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)

• kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)

• kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

• kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

• kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

• kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

• kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)

• kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)

• kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

• kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

• kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

Bug Fix(es) and Enhancement(s):

• scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers [rhel 8.6.z] (JIRA:Rocky Linux-194117)

• gfs2: harden gfs2_glock_hold [Rocky Linux-8] (JIRA:Rocky Linux-240340)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log. This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed). Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before. BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) nf_hook_slow (net/netfilter/core.c:619) nf_hook_direct_egress (net/packet/af_packet.c:257) packet_xmit (net/packet/af_packet.c:280) packet_sendmsg (net/packet/af_packet.c:3114) __sys_sendto (net/socket.c:2265)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)
• kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
• kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)
• kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)
• kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
• kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)
• kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
• kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)
• kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)
• kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)
• kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)
• kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)
• kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)
• kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)
• kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

Bug Fix(es) and Enhancement(s):

• scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers [almalinux 8.6.z] (JIRA:AlmaLinux-194117)
• gfs2: harden gfs2_glock_hold [AlmaLinux-8] (JIRA:AlmaLinux-240340)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)
• kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
• kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)
• kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)
• kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091)
• kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)
• kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
• kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)
• kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)
• kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)
• kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)
• kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)
• kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)
• kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)
• kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

Bug Fix(es) and Enhancement(s):

• scsi: mpt3sas: avoid freeing unallocated PCIe SGL buffers [almalinux 8.6.z] (JIRA:AlmaLinux-194117)
• gfs2: harden gfs2_glock_hold [AlmaLinux-8] (JIRA:AlmaLinux-240340)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_log: validate MAC header was set before dumping it

The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads dev->hard_header_len bytes out of bounds into the kernel log.

This is reachable via the netdev logger: nf_log_unknown_packet() calls dump_mac_header() unconditionally, and an skb sent through AF_PACKET with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still unset (__dev_queue_xmit(), which would reset it, is bypassed).

Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already uses, and replace the open-coded MAC header length test with skb_mac_header_len(). Only skbs with an unset MAC header are affected; valid ones are dumped as before.

BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831) Read of size 1 at addr ffff88800ea49d3f by task exploit/148 Call Trace: kasan_report (mm/kasan/report.c:595) dump_mac_header (net/netfilter/nf_log_syslog.c:831) nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963) nf_log_packet (net/netfilter/nf_log.c:260) nft_log_eval (net/netfilter/nft_log.c:60) nft_do_chain (net/netfilter/nf_tables_core.c:285) nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307) nf_hook_slow (net/netfilter/core.c:619) nf_hook_direct_egress (net/packet/af_packet.c:257) packet_xmit (net/packet/af_packet.c:280) packet_sendmsg (net/packet/af_packet.c:3114) __sys_sendto (net/socket.c:2265)

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• CVE-2025-68214
  • timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214}
• CVE-2024-58093
  • PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-64095
  • batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64096
  • batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64218
  • batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64115
  • vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• CVE-2026-64114
  • ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• CVE-2026-64113
  • ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• CVE-2026-64103
  • scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2025-39686
  • comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
• CVE-2025-38068
  • crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• CVE-2025-39901
  • i40e: remove read access to debugfs files {CVE-2025-39901}
• CVE-2023-54207
  • HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
• CVE-2023-53446
  • PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2025-71152
  • net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152}
• CVE-2026-53131
  • netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• CVE-2026-31685
  • netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-43458
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
• CVE-2023-53338
  • lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• CVE-2026-43076…

• CVE-2025-68214
  • timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214}
• CVE-2024-58093
  • PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-64095
  • batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64096
  • batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64218
  • batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64115
  • vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• CVE-2026-64114
  • ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• CVE-2026-64113
  • ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• CVE-2026-64103
  • scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2025-39686
  • comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
• CVE-2025-38068
  • crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• CVE-2025-39901
  • i40e: remove read access to debugfs files {CVE-2025-39901}
• CVE-2023-54207
  • HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
• CVE-2023-53446
  • PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2025-71152
  • net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152}
• CVE-2026-53131
  • netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• CVE-2026-31685
  • netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-43458
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
• CVE-2023-53338
  • lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• CVE-2026-43076…

• CVE-2025-39826
  • net: rose: convert 'use' field to refcount_t {CVE-2025-39826}
• CVE-2025-40146
  • blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
• CVE-2024-53216
  • nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
• CVE-2026-89778
  • isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• CVE-2026-23050
  • pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
• CVE-2025-68796
  • f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796}
• CVE-2025-68330
  • iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
• CVE-2025-40333
  • f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
• CVE-2025-40160
  • xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
• CVE-2023-54047
  • drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
• CVE-2025-68190
  • drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
• CVE-2025-68188
  • tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
• CVE-2026-89786
  • ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• CVE-2022-50764
  • ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
• CVE-2026-80785
  • fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
• CVE-2026-80788
  • nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788}
• CVE-2026-80747
  • drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}
• CVE-2026-80907
  • drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
• CVE-2026-80908
  • drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
• CVE-2026-80812
  • ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
• CVE-2026-80948
  • wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
• CVE-2025-40137
  • f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
• CVE-2023-54150
  • drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
• CVE-2026-89784
  • SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
• CVE-2026-89783
  • xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
• CVE-2026-89780
  • net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780}
• CVE-2026-89777
  • vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777}
• CVE-2026-89789
  • gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
• CVE-2025-68797
  • char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
• CVE-2025-68767
  • hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
• CVE-2026-63961
  • usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961}
• CVE-2026-63904
  • usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
• CVE-2022-50864
  • nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
• CVE-2025-68771
  • ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
• CVE-2025-68750
  • usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
• CVE-2026-80909
  • drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909}
• CVE-2026-74402
  • crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} *…

• CVE-2024-36894
  • usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
• CVE-2026-97447
  • ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
• CVE-2026-93822
  • PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
• CVE-2026-93826
  • HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• CVE-2026-97954
  • net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
• CVE-2026-97949
  • configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• CVE-2026-97931
  • ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• CVE-2026-97940
  • ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• CVE-2026-97539
  • usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• CVE-2026-74510
  • Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• CVE-2026-72084
  • scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-90321
  • ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-74637
  • perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• CVE-2026-74752
  • sctp: validate cookie AUTH state before use {CVE-2026-74752}
• CVE-2026-74387
  • ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• CVE-2026-80536
  • xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• CVE-2026-89659
  • NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• CVE-2026-80576
  • drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• CVE-2026-90223
  • nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
• CVE-2026-80994
  • net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• CVE-2026-72398
  • sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• CVE-2026-74583
  • net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• CVE-2026-72322
  • ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• CVE-2026-93095
  • hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
• CVE-2026-72472
  • nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-90421
  • PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• CVE-2026-64583
  • usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
• CVE-2026-68329
  • iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
• CVE-2026-89448
  • iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• CVE-2026-64001
  • ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
• CVE-2026-64305
  • crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• CVE-2026-64348
  • usb: free iso schedules on failed submit {CVE-2026-64348}
• CVE-2026-64422
  • net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• CVE-2026-90180
  • block:…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF {CVE-2026-98116}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• dm cache policy smq: check allocation under invalidate lock {CVE-2026-53265}
• RDMA/siw: Bound fragmented header copies by the remaining length {CVE-2026-98323}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• net: qrtr: ns: Fix use-after-free in driver remove() {CVE-2026-46047}
• RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043}
• gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984}
• gfs2: Add metapath_dibh helper {CVE-2026-45984}
• bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• gfs2: Fix slab-use-after-free in qd_put {CVE-2026-45861}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• sctp: purge outqueue on stale COOKIE-ECHO handling {CVE-2026-52924}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• wifi: nl80211: reject oversized EMA RNR lists {CVE-2026-53182}
• netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
• ppp: require CAP_NET_ADMIN in target…

• net: bridge: fix vlan tunnel dst refcnt when egressing {CVE-2021-47222}
• net: bridge: fix vlan tunnel dst null pointer dereference {CVE-2021-47223}
• writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378}
• writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
• writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
• fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount {CVE-2026-64378}
• libceph: validate banner payload length {CVE-2026-90067}
• drm/virtio: release the GEM object on virtio_gpu_vram_create() errors {CVE-2026-98606}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs {CVE-2026-74390}
• nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685}
• vdpa_sim_blk: reject out-of-range sector starts {CVE-2026-97991}
• Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
• HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
• nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482}
• nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386}
• bpf: mark a NULL call argument precise {CVE-2026-98019}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get {CVE-2026-72262}
• ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes() {CVE-2026-72262}
• Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• fs/resctrl: Fix UAF from worker threads when domains are removed {CVE-2026-93099}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
• openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• sctp: diag: reject stale associations in dump_one path {CVE-2026-52917}
• sctp: Hold sock lock while iterating over address list {CVE-2026-52917}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• nfsd: gate nfs3…

Upstream kernel version 6.18.39 fixes bugs and vulnerabilities. The kmod, bluez, wireless-regdb, firmware and drakx-installer-images packages have been updated to work with this new kernel.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

Root has patched CVE-2026-52942 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-52942 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-52942 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-52942 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify: fix…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify: fix…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31510: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb (bsc#1262603).
• CVE-2026-31624: HID: core: clamp report_size in s32ton() to avoid undefined shift (bsc#1263657).
• CVE-2026-43068: ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() (bsc#1264255).
• CVE-2026-43069: Bluetooth: hci_ll: Fix firmware leak on error path (bsc#1264190).
• CVE-2026-43123: fbcon: check return value of con2fb_acquire_newinfo() (bsc#1264598).
• CVE-2026-43124: pstore: ram_core: fix incorrect success return when vmap() fails (bsc#1264545).
• CVE-2026-43156: net: usb: pegasus: enable basic endpoint checking (bsc#1265092).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43180: net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode (bsc#1265093).
• CVE-2026-43211: PCI: Fix pci_slot_trylock() error handling (bsc#1264387).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43226: net/rds: No shortcut out of RDS_CONN_ERROR (bsc#1264544).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43253: iommu/amd: move wait_on_sem() out of spinlock (bsc#1264419).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43268: hfsplus: pretend special inodes as regular files (bsc#1265083).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43287: drm: Account property blob allocations to memcg (bsc#1265037).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43313: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (bsc#1264821).
• CVE-2026-43370: drm/amdgpu: Fix use-after-free race in VM acquire (bsc#1264782).
• CVE-2026-43373: net: ncsi: fix skb leak in error paths (bsc#1265079).
• CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time (bsc#1264744).
• CVE-2026-43425: usb: image: mdc800: kill download URB on timeout (bsc#1265133).
• CVE-2026-43427: usb: class: cdc-wdm: fix reordering issue in read code path (bsc#1264746).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (bsc#1265023).
• CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (bsc#1264794).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads (bsc#1265142).
• CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (bsc#1264790).
• CVE-2026-43493: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (bsc#1265627).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45857: scsi: csiostor: Fix dereference of null pointer rn (bsc#1266458).
• CVE-2026-45858: ext4: subdivide EXT4_EXT_DATA_VALID1 (bsc#1266773).
• CVE-2026-45871: tpm: st33zp24: Fix missing cleanup on get_burstcount() error (bsc#1266755).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45899: ext4: drop extent cache when splitting extent fails (bsc#1266883).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45915:…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert 'scsi: qla2xxx: Perform lockless command completion in abort path' (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).
• CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).
• CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).
• CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).
• CVE-2026-46170: mptcp: pm: reuse ID 0 after delete and re-add (bsc#1267714).
• CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (bsc#1266813).
• CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).
• CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).
• CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).
• CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678). -…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert 'scsi: qla2xxx: Perform lockless command completion in abort path' (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46137: mptcp: pm: ADD_ADDR rtx: fix potential data-race (bsc#1267570).
• CVE-2026-46147: KVM: arm64: Factor out pKVM hyp vcpu creation to separate function (bsc#1267689).
• CVE-2026-46158: mptcp: pm: ADD_ADDR rtx: always decrease sk refcount (bsc#1266880).
• CVE-2026-46168: mptcp: sockopt: set timestamp flags on subflow socket, not msk (bsc#1266869).
• CVE-2026-46170: mptcp: pm: reuse ID 0 after delete and re-add (bsc#1267714).
• CVE-2026-46180: wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task (bsc#1266813).
• CVE-2026-46189: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (bsc#1266918).
• CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656).
• CVE-2026-46234: vsock: fix buffer size clamping order (bsc#1266904).
• CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init (bsc#1267678). -…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Character device driver;
• Hardware random number generator core;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• System reset/shutdown drivers;
• Power sequencing drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• RPMSG subsystem;
• SLIMbus drivers;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Cadence USB3 driver;
• ULPI bus;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB Tower driver;
• Intel USBIO USB I/O expander driver;
• USS720 USB parallel port adapter driver;
• MediaTek USB3 DRD driver;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• VFIO drivers;
• Framebuffer layer;
• Virtio drivers;
• BTRFS file system;
• EROFS file system;
• exFAT file system;
• F2FS file system;
• File systems infrastructure;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• SMB network file system;
• UDF file system;
• XFS file system;
• Key management;
• BPF subsystem;
• Memory management;
• Software nodes and device properties;
• Glob pattern matching library;
• Memory Management;
• KVM subsystem;
• Mellanox drivers;
• Restartable sequences system call mechanism;
• Socket messages infrastructure;
• Network traffic control;
• Bluetooth subsystem;
• Netfilter;
• Networking core;
• Network sockets;
• TCP network protocol;
• io_uring subsystem;
• IPC subsystem;
• Audit subsystem;
• Perf events;
• Kernel fork() syscall;
• Locking primitives;
• Kernel module support;
• Scheduler infrastructure; -…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Character device driver;
• Hardware random number generator core;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• System reset/shutdown drivers;
• Power sequencing drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• RPMSG subsystem;
• SLIMbus drivers;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Cadence USB3 driver;
• ULPI bus;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB Tower driver;
• Intel USBIO USB I/O expander driver;
• USS720 USB parallel port adapter driver;
• MediaTek USB3 DRD driver;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• VFIO drivers;
• Framebuffer layer;
• Virtio drivers;
• BTRFS file system;
• EROFS file system;
• exFAT file system;
• F2FS file system;
• File systems infrastructure;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• SMB network file system;
• UDF file system;
• XFS file system;
• Key management;
• BPF subsystem;
• Memory management;
• Software nodes and device properties;
• Glob pattern matching library;
• Memory Management;
• KVM subsystem;
• Mellanox drivers;
• Restartable sequences system call mechanism;
• Socket messages infrastructure;
• Network traffic control;
• Bluetooth subsystem;
• Netfilter;
• Networking core;
• Network sockets;
• TCP network protocol;
• io_uring subsystem;
• IPC subsystem;
• Audit subsystem;
• Perf events;
• Kernel fork() syscall;
• Locking primitives;
• Kernel module support;
• Scheduler infrastructure; -…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Character device driver;
• Hardware random number generator core;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• System reset/shutdown drivers;
• Power sequencing drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• RPMSG subsystem;
• SLIMbus drivers;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Cadence USB3 driver;
• ULPI bus;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB Tower driver;
• Intel USBIO USB I/O expander driver;
• USS720 USB parallel port adapter driver;
• MediaTek USB3 DRD driver;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• VFIO drivers;
• Framebuffer layer;
• Virtio drivers;
• BTRFS file system;
• EROFS file system;
• exFAT file system;
• F2FS file system;
• File systems infrastructure;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• SMB network file system;
• UDF file system;
• XFS file system;
• Key management;
• BPF subsystem;
• Memory management;
• Software nodes and device properties;
• Glob pattern matching library;
• Memory Management;
• KVM subsystem;
• Mellanox drivers;
• Restartable sequences system call mechanism;
• Socket messages infrastructure;
• Network traffic control;
• Bluetooth subsystem;
• Netfilter;
• Networking core;
• Network sockets;
• TCP network protocol;
• io_uring subsystem;
• IPC subsystem;
• Audit subsystem;
• Perf events;
• Kernel fork() syscall;
• Locking primitives;
• Kernel module support;
• Scheduler infrastructure; -…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Character device driver;
• Hardware random number generator core;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• System reset/shutdown drivers;
• Power sequencing drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• RPMSG subsystem;
• SLIMbus drivers;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Cadence USB3 driver;
• ULPI bus;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB Tower driver;
• Intel USBIO USB I/O expander driver;
• USS720 USB parallel port adapter driver;
• MediaTek USB3 DRD driver;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• VFIO drivers;
• Framebuffer layer;
• Virtio drivers;
• BTRFS file system;
• EROFS file system;
• exFAT file system;
• F2FS file system;
• File systems infrastructure;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• SMB network file system;
• UDF file system;
• XFS file system;
• Key management;
• BPF subsystem;
• Memory management;
• Software nodes and device properties;
• Glob pattern matching library;
• Memory Management;
• KVM subsystem;
• Mellanox drivers;
• Restartable sequences system call mechanism;
• Socket messages infrastructure;
• Network traffic control;
• Bluetooth subsystem;
• Netfilter;
• Networking core;
• Network sockets;
• TCP network protocol;
• io_uring subsystem;
• IPC subsystem;
• Audit subsystem;
• Perf events;
• Kernel fork() syscall;
• Locking primitives;
• Kernel module support;
• Scheduler infrastructure; -…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Character device driver;
• Hardware random number generator core;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• System reset/shutdown drivers;
• Power sequencing drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• RPMSG subsystem;
• SLIMbus drivers;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• Trusted Execution Environment drivers;
• TTY drivers;
• Cadence USB3 driver;
• ULPI bus;
• USB core drivers;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB Tower driver;
• Intel USBIO USB I/O expander driver;
• USS720 USB parallel port adapter driver;
• MediaTek USB3 DRD driver;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• VFIO drivers;
• Framebuffer layer;
• Virtio drivers;
• BTRFS file system;
• EROFS file system;
• exFAT file system;
• F2FS file system;
• File systems infrastructure;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• SMB network file system;
• UDF file system;
• XFS file system;
• Key management;
• BPF subsystem;
• Memory management;
• Software nodes and device properties;
• Glob pattern matching library;
• Memory Management;
• KVM subsystem;
• Mellanox drivers;
• Restartable sequences system call mechanism;
• Socket messages infrastructure;
• Network traffic control;
• Bluetooth subsystem;
• Netfilter;
• Networking core;
• Network sockets;
• TCP network protocol;
• io_uring subsystem;
• IPC subsystem;
• Audit subsystem;
• Perf events;
• Kernel fork() syscall;
• Locking primitives;
• Kernel module support;
• Scheduler infrastructure;
• Signal handling…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• ARM64 architecture;
• Cryptographic API;
• PSP security protocol;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• System reset/shutdown drivers;
• Power sequencing drivers;
• Power supply drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• ARM64 architecture;
• Cryptographic API;
• PSP security protocol;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• System reset/shutdown drivers;
• Power sequencing drivers;
• Power supply drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• ARM64 architecture;
• Cryptographic API;
• PSP security protocol;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• System reset/shutdown drivers;
• Power sequencing drivers;
• Power supply drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Character device driver;
• Hardware random number generator core;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• CoreSight HW tracing drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• System reset/shutdown drivers;
• Power sequencing drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• RPMSG subsystem;
• SLIMbus drivers;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Cadence USB3 driver;
• ULPI bus;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB Tower driver;
• Intel USBIO USB I/O expander driver;
• USS720 USB parallel port adapter driver;
• MediaTek USB3 DRD driver;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• VFIO drivers;
• Framebuffer layer;
• Virtio drivers;
• BTRFS file system;
• EROFS file system;
• exFAT file system;
• F2FS file system;
• File systems infrastructure;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS file system;
• HFS+ file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• SMB network file system;
• UDF file system;
• XFS file system;
• Key management;
• BPF subsystem;
• Memory management;
• Software nodes and device properties;
• Glob pattern matching library;
• Memory Management;
• KVM subsystem;
• Mellanox drivers;
• Restartable sequences system call mechanism;
• Socket messages infrastructure;
• Network traffic control;
• Bluetooth subsystem;
• Netfilter;
• Networking core;
• Network sockets;
• TCP network protocol;
• io_uring subsystem;
• IPC subsystem;
• Audit subsystem;
• Perf events;
• Kernel fork() syscall;
• Locking primitives;
• Kernel module support;
• Scheduler infrastructure;
• Signal handling mechanism;
• Timer subsystem;
• Tracing infrastructure;
• Debug objects infrastructure;
• 6LoWPAN network protocol;
• IEEE 802 network protocols;
• 9P file system network protocol;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Devlink API;
• HSR network protocol;
• IEEE802154.4 network protocol;
• IPv4 networking;
• IPv6 networking; …