CVE-2026-53071

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_expect: use expect->helper

Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe.

Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.(CVE-2026-31414)

In the Linux kernel, the following vulnerability has been resolved:

xfs: avoid dereferencing log items after push callbacks

After xfsaild_push_item() calls iop_push(), the log item may have been freed if the AIL lock was dropped during the push. Background inode reclaim or the dquot shrinker can free the log item while the AIL lock is not held, and the tracepoints in the switch statement dereference the log item after iop_push() returns.

Fix this by capturing the log item type, flags, and LSN before calling xfsaild_push_item(), and introducing a new xfs_ail_push_class trace event class that takes these pre-captured values and the ailp pointer instead of the log item pointer.(CVE-2026-31453)

In the Linux kernel, the following vulnerability has been resolved:

xfs: stop reclaim before pushing AIL during unmount

The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes.

Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.(CVE-2026-31455)

In the Linux kernel, the following vulnerability has been resolved:

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read.

This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL.

The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs.(CVE-2026-43112)

In the Linux kernel, the following vulnerability has been resolved:

xfs: remove xfs_attr_leaf_hasname

The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL buffer pointer for an already released buffer when xfs_attr3_leaf_lookup_int fails with other error values.

Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so that the buffer release code is done by each caller of xfs_attr3_leaf_read.(CVE-2026-43153)

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix freemap adjustments when adding xattrs to leaf blocks

xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test VMs:

ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t) + xfs_attr3_leaf_hdr_size(leaf));

Upon enabling quite a lot more debugging code, I narrowed this down to fsstress trying to set a local extended attribute with…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()

Simplify the code by using device managed memory allocations.

This also fixes a memory leak in rtw_register_hw(). The supported bands were not freed in the error path.

Copied from commit 145df52a8671 ("wifi: rtw89: Convert rtw89_core_set_supported_band to use devm_*").(CVE-2025-71273)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold dev ref until after transport_finish NF_HOOK

After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb->dev pointer is then used inside NF_HOOK and its okfn, which can race with device teardown.

Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn.

For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.(CVE-2026-31663)

In the Linux kernel, the following vulnerability has been resolved:

x86: shadow stacks: proper error handling for mmap lock

김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also shows that we haven't marked those functions with "__must_check", which would have immediately caught it.

So let's fix both issues.(CVE-2026-43109)

In the Linux kernel, the following vulnerability has been resolved:

srcu: Use irq_work to start GP in tiny SRCU

Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool->lock.

This causes a lockdep splat when call_srcu() is called with a scheduler lock held, due to:

call_srcu() [holding pi_lock] srcu_gp_start_if_needed() schedule_work() -> pool->lock

workqueue_init() / create_worker() [holding pool->lock] wake_up_process() -> try_to_wake_up() -> pi_lock

Also add irq_work_sync() to cleanup_srcu_struct() to prevent a use-after-free if a queued irq_work fires after cleanup begins.

Tested with rcutorture SRCU-T and no lockdep warnings.

Thanks to Boqun for similar fix in patch "rcu: Use an intermediate irq_work to start process_srcu()"

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: fix 22000 series SMEM parsing

If the firmware were to report three LMACs (which doesn't exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is an overrun of the array. Reject such and use IWL_FW_CHECK instead of WARN_ON in this function.(CVE-2026-43172)

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix type confusion in bond_setup_by_slave()

kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306 RSP: 0018:ffffc90004aff760 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900 RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000 R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780 R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0 Call Trace: <TASK> ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900 dev_hard_header include/linux/netdevice.h:3439 [inline] packet_snd net/packet/af_packet.c:3028 [inline] packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

• kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

Bug Fix(es) and Enhancement(s):

• [rhel-8] WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected - at: vmd_pci_write+0x85/0xe0 - deadlock (JIRA:Rocky Linux-174916)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)

• kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

Bug Fix(es) and Enhancement(s):

• [rhel-8] WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected - at: vmd_pci_write+0x85/0xe0 - deadlock (JIRA:Rocky Linux-174916)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)

• kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)

• kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)

• kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)

• kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)

• kernel: fanotify: fix false positive on permission events (CVE-2026-46150)

• kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)

• kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)

• kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)

• kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)

• kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

• kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()

Bug Fix(es) and Enhancement(s):

• nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:Rocky Linux-173103)

• tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [rhel-10.2.z] (JIRA:Rocky Linux-183975)

• [Rocky Linux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [rhel-10.2.z] (JIRA:Rocky Linux-186311)

• ice: driver update 2026-06, part 1 [rhel-10.2.z] (JIRA:Rocky Linux-191324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)

• kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)

• kernel: Linux kernel: xfrm single-frag length not properly limited ()

• kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)

• kernel: fanotify: fix false positive on permission events (CVE-2026-46150)

• kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)

• kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

• kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()

Bug Fix(es) and Enhancement(s):

• [Rocky Linux9] tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [rhel-9.8.z] (JIRA:Rocky Linux-183980)

• [Rocky Linux-9.8.z]: mlx5: include bug fixes (JIRA:Rocky Linux-188121)

• dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [rhel-9.8.z] (JIRA:Rocky Linux-212061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file acquires the lock first. A remote BLE device can send a crafted L2CAP ECRED reconfiguration response to corrupt the channel list while another thread is iterating it. Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(), and l2cap_chan_unlock() and l2cap_chan_put() after, matching the pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
• kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

Bug Fix(es) and Enhancement(s):

• [almalinux-8] WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected - at: vmd_pci_write+0x85/0xe0 - deadlock (JIRA:AlmaLinux-174916)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117)
• kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

Bug Fix(es) and Enhancement(s):

• [almalinux-8] WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected - at: vmd_pci_write+0x85/0xe0 - deadlock (JIRA:AlmaLinux-174916)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)
• kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147)
• kernel: flex_proportions: make fprop_new_period() hardirq safe (CVE-2026-23168)
• kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)
• kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116)
• kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
• kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)
• kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)
• kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950)
• kernel: ice: fix double-free of tx_buf skb (CVE-2026-53009)
• kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)
• kernel: can: bcm: thrtimer use-after-free during RX operation teardown ()

Bug Fix(es) and Enhancement(s):

• nfsd_file slab cache objects remaining on kmem_cache_shutdown during nfsd teardown while running bz1477872 testcase (JIRA:AlmaLinux-173103)
• tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-10.2.z] (JIRA:AlmaLinux-183975)
• [AlmaLinux10-debug]: BUG: KASAN: slab-use-after-free in __pv_queued_spin_lock_slowpath [almalinux-10.2.z] (JIRA:AlmaLinux-186311)
• ice: driver update 2026-06, part 1 [almalinux-10.2.z] (JIRA:AlmaLinux-191324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113)
• kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)
• kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099)
• kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
• kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215)
• kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

Bug Fix(es) and Enhancement(s):

• [AlmaLinux9] tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-9.8.z] (JIRA:AlmaLinux-183980)
• [AlmaLinux-9.8.z]: mlx5: include bug fixes (JIRA:AlmaLinux-188121)
• dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-9.8.z] (JIRA:AlmaLinux-212061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• mac802154: llsec: reject frames shorter than the authentication tag {CVE-2026-68125}
• KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428}
• wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper {CVE-2026-68197}
• bpf: account for current allocated stack depth in widen_imprecise_scalars() {CVE-2025-68208}
• tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322}
• smb: client: fix potential cfid UAF in smb2_query_info_compound {CVE-2025-40320}
• net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• binfmt_misc: set have_execfd only once the interpreter is opened {CVE-2026-68186}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• tipc: fix u16 MTU truncation in media and bearer MTU validation {CVE-2026-68297}
• net: gro: fix double aggregation of flush-marked skbs {CVE-2026-68136}
• bpf, sockmap: Reject unhashed UDP sockets on sockmap update {CVE-2026-68386}
• wifi: brcmfmac: fix 802.1X-SHA256 call trace warning {CVE-2026-68304}
• udf: fix partition descriptor append bookkeeping {CVE-2026-45991}
• Bluetooth: SCO: fix race conditions in sco_sock_connect() {CVE-2026-43023}
• smb: client: validate dacloffset before building DACL pointers {CVE-2026-46195}
• smb/client: fix out-of-bounds read in symlink_data() {CVE-2026-46185}
• net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• RDMA/mana: Validate rx_hash_key_len {CVE-2026-46145}
• scsi: qla2xxx: Completely fix fcport double free {CVE-2026-43414}
• bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• wifi: mac80211: use safe list iteration in radar detect work {CVE-2026-46166}
• RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads {CVE-2026-46114}
• nfsd: never defer requests during idmap lookup {CVE-2026-45983}
• drop_monitor: fix size calculations for 64-bit attributes {CVE-2026-68287}
• openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
• dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
• netfilter: nft_inner: Fix IPv6 inner_thoff desync {CVE-2026-46244}
• drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() {CVE-2026-68429}
• crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
• RDMA/rxe: Fix race condition in QP timer handlers {CVE-2026-45910}
• wifi: mac80211: remove station if connection prep fails {CVE-2026-46125}
• tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
• scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk {CVE-2025-38289}
• net/sched: act_ct: Only release RCU read lock after ct_ft {CVE-2026-46319}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• io-wq: check that the predecessor is hashed in io_wq_remove_pending() {CVE-2026-46274}
• wifi: mac80211: drop stray 'static' from fast-RX rx_result {CVE-2026-46152}
• io_uring/poll: fix signed comparison in io_poll_get_ownership() {CVE-2026-52933}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• Bluetooth: btusb: validate Realtek vendor event length {CVE-2026-68339}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
• ipc: limit next_id…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• smb: client: harden POSIX SID length parsing {CVE-2026-64380}
• RDMA: Fix use-after-free in rxe_queue_cleanup {CVE-2021-47616}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047}
• tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
• net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• thunderbolt: Bound root directory content to block size {CVE-2026-53149}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537}
• SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
• ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006}
• ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002}
• Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697}
• HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729}
• net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
• Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp {CVE-2026-53071}
• Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails {CVE-2026-53071}
• scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856}
• drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} -…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF {CVE-2026-98116}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• dm cache policy smq: check allocation under invalidate lock {CVE-2026-53265}
• RDMA/siw: Bound fragmented header copies by the remaining length {CVE-2026-98323}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• net: qrtr: ns: Fix use-after-free in driver remove() {CVE-2026-46047}
• RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043}
• gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984}
• gfs2: Add metapath_dibh helper {CVE-2026-45984}
• bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• gfs2: Fix slab-use-after-free in qd_put {CVE-2026-45861}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• sctp: purge outqueue on stale COOKIE-ECHO handling {CVE-2026-52924}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• wifi: nl80211: reject oversized EMA RNR lists {CVE-2026-53182}
• netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
• ppp: require CAP_NET_ADMIN in target…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

Root has patched CVE-2026-53071 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-53071 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-53071 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-53071 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs (bsc#1264562).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43079: perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1264228).
• CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).
• CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).
• CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).
• CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).
• CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).
• CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).
• CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).
• CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).
• CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).
• CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).
• CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).
• CVE-2026-43303: mm/page_alloc: clear page->private in free_pages_prepare() (bsc#1264974).
• CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).
• CVE-2026-43420: ceph: fix i_nlink underrun during async unlink (bsc#1264814).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).
• CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).
• CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).
• CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).
• CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).
• CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).
• CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).
• CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).
• CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).
• CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).
• CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs (bsc#1264562).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43079: perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1264228).
• CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).
• CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).
• CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).
• CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).
• CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).
• CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).
• CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).
• CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).
• CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).
• CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).
• CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).
• CVE-2026-43303: mm/page_alloc: clear page->private in free_pages_prepare() (bsc#1264974).
• CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).
• CVE-2026-43420: ceph: fix i_nlink underrun during async unlink (bsc#1264814).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).
• CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).
• CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).
• CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).
• CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).
• CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).
• CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).
• CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).
• CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).
• CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).
• CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs (bsc#1264562).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43079: perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1264228).
• CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).
• CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).
• CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).
• CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).
• CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).
• CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).
• CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).
• CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).
• CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).
• CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).
• CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).
• CVE-2026-43303: mm/page_alloc: clear page->private in free_pages_prepare() (bsc#1264974).
• CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).
• CVE-2026-43420: ceph: fix i_nlink underrun during async unlink (bsc#1264814).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).
• CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).
• CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).
• CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).
• CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).
• CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).
• CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).
• CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).
• CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).
• CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).
• CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs (bsc#1264562).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43079: perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1264228).
• CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).
• CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).
• CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).
• CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).
• CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).
• CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).
• CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).
• CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).
• CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).
• CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).
• CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).
• CVE-2026-43303: mm/page_alloc: clear page->private in free_pages_prepare() (bsc#1264974).
• CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).
• CVE-2026-43420: ceph: fix i_nlink underrun during async unlink (bsc#1264814).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).
• CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key() (bsc#1266396).
• CVE-2026-45848: apparmor: fix NULL sock in aa_sock_file_perm (bsc#1266734).
• CVE-2026-45891: net: hns3: fix double free issue for tx spare buffer (bsc#1266717).
• CVE-2026-45912: ext4: don't cache extent during splitting extent (bsc#1266899).
• CVE-2026-45948: ext4: fix memory leak in ext4_ext_shift_extents() (bsc#1266929).
• CVE-2026-45985: ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O (bsc#1266700).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-46053: net: rds: fix MR cleanup on copy error (bsc#1267427).
• CVE-2026-46063: x86/shstk: Prevent deadlock during shstk sigreturn (bsc#1267228).
• CVE-2026-46065: fbdev: defio: Disconnect deferred I/O from the lifetime of struct (bsc#1267458).
• CVE-2026-46069: wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (bsc#1267437).
• CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-10263: arm64: cputype: Add C1-Ultra definitions (bsc#1266290).
• CVE-2025-40216: io_uring/rsrc: don't rely on user vaddr alignment (bsc#1259764).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2025-68822: Input: alps - fix use-after-free bugs caused by dev3_register_work (bsc#1256668).
• CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs (bsc#1264562).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper (bsc#1262085).
• CVE-2026-31429: net: skb: fix cross-cache free of KFENCE-allocated skb head (bsc#1262392).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31452: ext4: convert inline data to extents when truncate exceeds inline size (bsc#1262620).
• CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31469: virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (bsc#1267816).
• CVE-2026-31492: RDMA/irdma: Initialize free_qp completion before using it (bsc#1262748).
• CVE-2026-31495: netfilter: ctnetlink: use netlink policy range checks (bsc#1262798).
• CVE-2026-31499: Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (bsc#1262674).
• CVE-2026-31500: Bluetooth: hci_sync: Remove remaining dependencies of hci_request (bsc#1262993).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path (bsc#1263178).
• CVE-2026-31560: spi: spi-dw-dma: fix print error log when wait finish transaction (bsc#1263057).
• CVE-2026-31592: KVM: SEV: Protect all of sev_mem_enc_register_region() with kvm->lock (bsc#1263123).
• CVE-2026-31593: KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (bsc#1263124).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31664: xfrm: clear trailing padding in build_polexpire() (bsc#1263578).
• CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy (bsc#1263137).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31674: netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (bsc#1263568).
• CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).
• CVE-2026-31680: net: ipv6: flowlabel: defer exclusive option free until RCU teardown (bsc#1263563).
• CVE-2026-31693: cifs: some missing initializations on replay (bsc#1267744).
• CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
• CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).
• CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
• CVE-2026-31752: bridge: br_nd_send: validate ND option lengths (bsc#1264045).
• CVE-2026-31759: usb: ulpi: fix double free in ulpi_register_interface() error path (bsc#1264076).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43023: Bluetooth: SCO: fix race conditions in sco_sock_connect() (bsc#1264137).
• CVE-2026-43024: netfilter: nf_tables: reject immediate NF_QUEUE verdict (bsc#1263930).
• CVE-2026-43028: netfilter: x_tables: ensure names are nul-terminated…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-40216: io_uring/rsrc: don't rely on user vaddr alignment (bsc#1259764).
• CVE-2025-40341: futex: Don't leak robust_list pointer on exec race (bsc#1255029).
• CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs (bsc#1264562).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31450: ext4: publish jinode after initialization (bsc#1262618).
• CVE-2026-31462: drm/amdgpu: prevent immediate PASID reuse case (bsc#1262655).
• CVE-2026-31466: mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (bsc#1267825).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-31647: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (bsc#1263581).
• CVE-2026-31670: net: rfkill: prevent unlimited numbers of rfkill events from being created (bsc#1263573).
• CVE-2026-31677: crypto: af_alg - limit RX SG extraction by receive buffer budget (bsc#1263560).
• CVE-2026-31697: crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (bsc#1264116).
• CVE-2026-31698: crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (bsc#1263880).
• CVE-2026-31699: crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (bsc#1263879).
• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43010: bpf: Reject sleepable kprobe_multi programs at attach time (bsc#1264015).
• CVE-2026-43022: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (bsc#1264001).
• CVE-2026-43034: bnxt_en: set backing store type from query type (bsc#1263998).
• CVE-2026-43053: xfs: close crash window in attr dabtree inactivation (bsc#1264084).
• CVE-2026-43074: eventpoll: defer struct eventpoll free to RCU grace period (bsc#1264263).
• CVE-2026-43079: perf/x86/intel/uncore: Skip discovery table for offline dies (bsc#1264228).
• CVE-2026-43080: l2tp: Drop large packets with UDP encap (bsc#1264236).
• CVE-2026-43081: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+ (bsc#1264241).
• CVE-2026-43085: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (bsc#1264230).
• CVE-2026-43086: ipvs: fix NULL deref in ip_vs_add_service error path (bsc#1264286).
• CVE-2026-43089: xfrm_user: fix info leak in build_mapping() (bsc#1264261).
• CVE-2026-43093: xsk: tighten UMEM headroom validation to account for tailroom and min frame (bsc#1264254).
• CVE-2026-43094: ixgbevf: add missing negotiate_features op to Hyper-V ops table (bsc#1264231).
• CVE-2026-43107: xfrm: account XFRMA_IF_ID in aevent size calculation (bsc#1264258).
• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-43128: RDMA/umem: Fix double dma_buf_unpin in failure path (bsc#1264612).
• CVE-2026-43139: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() (bsc#1264294).
• CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (bsc#1264337).
• CVE-2026-43238: net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (bsc#1264320).
• CVE-2026-43303: mm/page_alloc: clear page->private in free_pages_prepare() (bsc#1264974).
• CVE-2026-43336: lib/crypto: chacha: Zeroize permuted_state before it leaves scope (bsc#1265113).
• CVE-2026-43420: ceph: fix i_nlink underrun during async unlink (bsc#1264814).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-43472: unshare: fix unshare_fs() handling (bsc#1264748).
• CVE-2026-43492: lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() (bsc#1265629).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-45838: bpf: fix end-of-list detection in cgroup_storage_get_next_key()…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
• CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop (bsc#1267531).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).
• CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).
• CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).
• CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
• CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).
• CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
• CVE-2026-46330: Revert 'net/smc: Introduce TCP ULP support' (bsc#1268049).
• CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1265421).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).
• CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
• CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).
• CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
• CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
• CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).
• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
• CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
• CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).
• CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).
• CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269821).
• CVE-2026-53253: Bluetooth: bnep: reject short frames before parsing (bsc#1269574).
• CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-31771: Bluetooth: Ignore HCI_ERROR_CANCELLED_BY_HOST on adv set terminated event (bsc#1264145).
• CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
• CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop (bsc#1267531).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).
• CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).
• CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
• CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).
• CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
• CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1265421).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).
• CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
• CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).
• CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
• CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
• CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).
• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
• CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
• CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).
• CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).
• CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269821).
• CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (bsc#1269574).
• CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-31771: Bluetooth: hci_event: move wake reason storage into validated event handlers (bsc#1264145).
• CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
• CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop (bsc#1267531).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).
• CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).
• CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
• CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).
• CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
• CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1265421).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).
• CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
• CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).
• CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
• CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
• CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).
• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
• CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
• CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).
• CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).
• CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269821).
• CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (bsc#1269574).
• CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-31771: Bluetooth: Ignore HCI_ERROR_CANCELLED_BY_HOST on adv set terminated event (bsc#1264145).
• CVE-2026-43038: ipv6: icmp: clear skb2->cb in ip6_err_gen_icmpv6_unreach() (bsc#1264097).
• CVE-2026-46090: ALSA: aloop: Fix peer runtime UAF during format-change stop (bsc#1267531).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).
• CVE-2026-46197: drm/amdkfd: validate SVM ioctl nattr against buffer size (bsc#1267381).
• CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).
• CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
• CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).
• CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
• CVE-2026-46331: net/sched: fix pedit partial COW leading to page cache (bsc#1265421).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).
• CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
• CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).
• CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
• CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
• CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).
• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
• CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
• CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).
• CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).
• CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269821).
• CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (bsc#1269574).
• CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2026-43109: x86: shadow stacks: proper error handling for mmap lock (bsc#1264484).
• CVE-2026-46052: ceph: only d_add() negative dentries when they are unhashed (bsc#1267494).
• CVE-2026-46071: KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (bsc#1267591).
• CVE-2026-46076: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (bsc#1267365).
• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267369).
• CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task (bsc#1267722).
• CVE-2026-46229: drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure (bsc#1267567).
• CVE-2026-46242: eventpoll: Fix integer overflow in ep_loop_check_proc() (bsc#1267618).
• CVE-2026-46253: pstore/ram: fix buffer overflow in persistent_ram_save_old() (bsc#1267635).
• CVE-2026-46266: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (bsc#1267684).
• CVE-2026-46289: lib/scatterlist: fix length calculations in extract_kvec_to_sg (bsc#1267966).
• CVE-2026-46319: net/sched: act_ct: Only release RCU read lock after ct_ft (bsc#1268022).
• CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp() (bsc#1267993).
• CVE-2026-46330: Revert 'net/smc: Introduce TCP ULP support' (bsc#1268049).
• CVE-2026-52909: ip6_vti: set netns_immutable on the fallback device (bsc#1268660).
• CVE-2026-52918: Bluetooth: serialize accept_q access (bsc#1269100).
• CVE-2026-52923: ipc: limit next_id allocation to the valid ID range (bsc#1269033).
• CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling (bsc#1269036).
• CVE-2026-52933: io_uring/poll: fix signed comparison in io_poll_get_ownership() (bsc#1268989).
• CVE-2026-52943: net: skbuff: fix missing zerocopy reference in pskb_carve helpers (bsc#1269022).
• CVE-2026-52955: libceph: Fix potential out-of-bounds access in crush_decode() (bsc#1269159).
• CVE-2026-52956: libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() (bsc#1269172).
• CVE-2026-52958: libceph: Fix potential out-of-bounds access in osdmap_decode() (bsc#1269174).
• CVE-2026-52969: KVM: Reject wrapped offset in kvm_reset_dirty_gfn() (bsc#1269184).
• CVE-2026-52972: crypto: af_alg - Cap AEAD AD length to 0x80000000 (bsc#1269195).
• CVE-2026-52993: tipc: fix double-free in tipc_buf_append() (bsc#1269193).
• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269090).
• CVE-2026-53041: ocfs2: fix listxattr handling when the buffer is full (bsc#1269398).
• CVE-2026-53052: ASoC: qcom: qdsp6: topology: check widget type before accessing data (bsc#1269314).
• CVE-2026-53053: iommu/amd: Fix clone_alias() to use the original device's devid (bsc#1269310).
• CVE-2026-53071: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (bsc#1269678).
• CVE-2026-53072: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (bsc#1269681).
• CVE-2026-53133: RDMA/umem: Fix truncation for block sizes >= 4G (bsc#1269821).
• CVE-2026-53178: staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction (bsc#1269795).
• CVE-2026-53182: wifi: nl80211: reject oversized EMA RNR lists (bsc#1269884).
• CVE-2026-53196: USB: serial: io_ti: fix heap overflow in get_manuf_info() (bsc#1269986).
• CVE-2026-53253: Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (bsc#1269574).
• CVE-2026-53256: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (bsc#1269993).
• CVE-2026-53357: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (bsc#1270257).
• CVE-2026-53359: KVM: x86: Fix shadow paging use-after-free due to unexpected role (bsc#1270059).
• CVE-2026-53362: ipv6: account for fraggap on the paged allocation path (bsc#1269493).
• CVE-2026-53366: ipv4: account for fraggap on the paged allocation path (bsc#1271366).

The following non security…

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PSP security protocol;
• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Intel NPU Driver;
• DRBD Distributed Replicated Block Device drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• EDAC drivers;
• EFI core;
• FWCTL subsystem;
• GPU drivers;
• HID subsystem;
• I3C subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• x86 platform drivers;
• Generic PM domains;
• MediaTek PM domains;
• Power supply drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• S/390 drivers;
• SCSI subsystem;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• TTY drivers;
• USB Device Class drivers;
• ULPI bus;
• USB Type-C support driver;
• TI TPS6598x USB Power Delivery controller driver;
• vDPA drivers;
• VFIO drivers;
• Framebuffer layer;
• TSM AMD SEV Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• HugeTLB file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Overlay file system;
• Diskquota system;
• SMB network file system;
• Tracing file system;
• DRM TTM subsystem;
• Control group (cgroup);
• Kernel CPU control infrastructure;
• QorIQ DPAA2 FSL-MC bus driver;
• Freescale ENETC Ethernet drivers;
• Memory Management;
• padata parallel execution mechanism;
• PPP protocol drivers and compressors;
• Bluetooth subsystem;
• Networking core;
• Netfilter;
• Network traffic control;
• io_uring subsystem;
• IPC subsystem;
• Audit subsystem;
• BPF subsystem;
• Kernel exit() syscall;
• Kernel fork() syscall;
• Kernel futex primitives;
• Padata parallel execution mechanism;
• Scheduler infrastructure;
• Tracing infrastructure;
• Cryptographic library;
• Memory management;
• 802.1Q VLAN protocol;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Ceph Core library;
• Distributed Switch Architecture;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Open vSwitch;
• Phonet protocol;
• RDS protocol;
• SCTP protocol;
• SMC sockets;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• SELinux security module;
• ALSA framework;
• HD-audio driver;
• QCOM ASoC drivers; -…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PSP security protocol;
• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Intel NPU Driver;
• DRBD Distributed Replicated Block Device drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• EDAC drivers;
• EFI core;
• FWCTL subsystem;
• GPU drivers;
• HID subsystem;
• I3C subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• x86 platform drivers;
• Generic PM domains;
• MediaTek PM domains;
• Power supply drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• S/390 drivers;
• SCSI subsystem;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• TTY drivers;
• USB Device Class drivers;
• ULPI bus;
• USB Type-C support driver;
• TI TPS6598x USB Power Delivery controller driver;
• vDPA drivers;
• VFIO drivers;
• Framebuffer layer;
• TSM AMD SEV Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• HugeTLB file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Diskquota system;
• SMB network file system;
• Tracing file system;
• DRM TTM subsystem;
• Control group (cgroup);
• Kernel CPU control infrastructure;
• QorIQ DPAA2 FSL-MC bus driver;
• Freescale ENETC Ethernet drivers;
• Memory Management;
• padata parallel execution mechanism;
• PPP protocol drivers and compressors;
• Bluetooth subsystem;
• Networking core;
• Netfilter;
• Network traffic control;
• io_uring subsystem;
• IPC subsystem;
• Audit subsystem;
• BPF subsystem;
• Kernel exit() syscall;
• Kernel fork() syscall;
• Kernel futex primitives;
• Padata parallel execution mechanism;
• Scheduler infrastructure;
• Tracing infrastructure;
• Cryptographic library;
• Memory management;
• 802.1Q VLAN protocol;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• Ceph Core library;
• Distributed Switch Architecture;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Multipath TCP;
• Open vSwitch;
• Phonet protocol;
• RDS protocol;
• SCTP protocol;
• SMC sockets;
• TIPC protocol;
• TLS protocol;
• Unix domain sockets;
• VMware vSockets driver;
• XFRM subsystem;
• Integrity Measurement Architecture(IMA) framework;
• SELinux security module;
• ALSA framework;
• HD-audio driver;
• QCOM ASoC drivers;
• SOF drivers;
• STI ASoC…