CVE-2026-63802

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries. Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()

Simplify the code by using device managed memory allocations.

This also fixes a memory leak in rtw_register_hw(). The supported bands were not freed in the error path.

Copied from commit 145df52a8671 ("wifi: rtw89: Convert rtw89_core_set_supported_band to use devm_*").(CVE-2025-71273)

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold dev ref until after transport_finish NF_HOOK

After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The skb->dev pointer is then used inside NF_HOOK and its okfn, which can race with device teardown.

Remove the dev_put from the async resumption entry and instead drop the reference after the NF_HOOK call in transport_finish, using a saved device pointer since NF_HOOK may consume the skb. This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip the okfn.

For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.(CVE-2026-31663)

In the Linux kernel, the following vulnerability has been resolved:

x86: shadow stacks: proper error handling for mmap lock

김영민 reports that shstk_pop_sigframe() doesn't check for errors from mmap_read_lock_killable(), which is a silly oversight, and also shows that we haven't marked those functions with "__must_check", which would have immediately caught it.

So let's fix both issues.(CVE-2026-43109)

In the Linux kernel, the following vulnerability has been resolved:

srcu: Use irq_work to start GP in tiny SRCU

Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool->lock.

This causes a lockdep splat when call_srcu() is called with a scheduler lock held, due to:

call_srcu() [holding pi_lock] srcu_gp_start_if_needed() schedule_work() -> pool->lock

workqueue_init() / create_worker() [holding pool->lock] wake_up_process() -> try_to_wake_up() -> pi_lock

Also add irq_work_sync() to cleanup_srcu_struct() to prevent a use-after-free if a queued irq_work fires after cleanup begins.

Tested with rcutorture SRCU-T and no lockdep warnings.

Thanks to Boqun for similar fix in patch "rcu: Use an intermediate irq_work to start process_srcu()"

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: fix 22000 series SMEM parsing

If the firmware were to report three LMACs (which doesn't exist in hardware) then using "fwrt->smem_cfg.lmac[2]" is an overrun of the array. Reject such and use IWL_FW_CHECK instead of WARN_ON in this function.(CVE-2026-43172)

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix type confusion in bond_setup_by_slave()

kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306 RSP: 0018:ffffc90004aff760 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900 RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000 R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780 R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0 Call Trace: <TASK> ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900 dev_hard_header include/linux/netdevice.h:3439 [inline] packet_snd net/packet/af_packet.c:3028 [inline] packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)

• kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)

• kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

• kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

• kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

• kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)

• kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)

• kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)

• kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

• kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

• kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

• kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)

• kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)

• kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)

• kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)

• kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)

• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

• kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)

• kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)

• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)

• kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)

• kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201)

• kernel: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CVE-2026-72261)

• kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)

• kernel: net: tun: bound receive headroom (CVE-2026-81000)

• kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)

Bug Fix(es) and Enhancement(s):

• sctp: prevent peer transport count overflow [rhel-9.8.z] (JIRA:Rocky Linux-216251)

• netfilter: nftables CVE and memory safety backports for 9.8 (JIRA:Rocky Linux-236634)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush() removes another blkg's iostat entries via llist_del_all(). The second blkg sees an empty list and proceeds to free itself while the first is still iterating over its entries. Move the flush from __blkg_release() (RCU callback) to blkg_release() (before call_rcu). This ensures the RCU grace period waits for any concurrent flush's rcu_read_lock() section to complete before freeing.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)
• kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)
• kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
• kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
• kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
• kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
• kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)
• kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)
• kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
• kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
• kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
• kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
• kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
• kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)
• kernel: af_unix: Drop all SCM attributes for SOCKMAP (CVE-2026-53005)
• kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)
• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
• kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)
• kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)
• kernel: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CVE-2026-64534)
• kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
• kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201)
• kernel: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CVE-2026-72261)
• kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
• kernel: net: tun: bound receive headroom (CVE-2026-81000)
• kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)

Bug Fix(es) and Enhancement(s):

• sctp: prevent peer transport count overflow [almalinux-9.8.z] (JIRA:AlmaLinux-216251)
• netfilter: nftables CVE and memory safety backports for 9.8 (JIRA:AlmaLinux-236634)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: block: zero non-PI portion of auto integrity buffer (CVE-2026-23007)
• kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266)
• kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)
• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
• kernel: block: don't overwrite bip_vcnt in bio_integrity_copy_user() (CVE-2026-64053)
• kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)
• kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
• kernel: ALSA: timer: drain a slave's callback before its master detaches it (CVE-2026-68201)
• kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)
• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
• kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
• kernel: net: tun: bound receive headroom (CVE-2026-81000)
• kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)

Bug Fix(es) and Enhancement(s):

• kernel module .ko ELF files with non-zero sh_addr section addresses [almalinux-10.2.z] (JIRA:AlmaLinux-159298)
• sctp: prevent peer transport count overflow [almalinux-10.2.z] (JIRA:AlmaLinux-216247)
• [AlmaLinux 10] bnxt_en: RX queue restart failed: err=-95 [almalinux-10.2.z] (JIRA:AlmaLinux-247283)
• RHIVOS - S32G: backport missing fixes to 10.2 (JIRA:AlmaLinux-259788)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• mac802154: llsec: reject frames shorter than the authentication tag {CVE-2026-68125}
• KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428}
• wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper {CVE-2026-68197}
• bpf: account for current allocated stack depth in widen_imprecise_scalars() {CVE-2025-68208}
• tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322}
• smb: client: fix potential cfid UAF in smb2_query_info_compound {CVE-2025-40320}
• net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• binfmt_misc: set have_execfd only once the interpreter is opened {CVE-2026-68186}
• tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175}
• tipc: fix u16 MTU truncation in media and bearer MTU validation {CVE-2026-68297}
• net: gro: fix double aggregation of flush-marked skbs {CVE-2026-68136}
• bpf, sockmap: Reject unhashed UDP sockets on sockmap update {CVE-2026-68386}
• wifi: brcmfmac: fix 802.1X-SHA256 call trace warning {CVE-2026-68304}
• udf: fix partition descriptor append bookkeeping {CVE-2026-45991}
• Bluetooth: SCO: fix race conditions in sco_sock_connect() {CVE-2026-43023}
• smb: client: validate dacloffset before building DACL pointers {CVE-2026-46195}
• smb/client: fix out-of-bounds read in symlink_data() {CVE-2026-46185}
• net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• RDMA/mana: Validate rx_hash_key_len {CVE-2026-46145}
• scsi: qla2xxx: Completely fix fcport double free {CVE-2026-43414}
• bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• wifi: mac80211: use safe list iteration in radar detect work {CVE-2026-46166}
• RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads {CVE-2026-46114}
• nfsd: never defer requests during idmap lookup {CVE-2026-45983}
• drop_monitor: fix size calculations for 64-bit attributes {CVE-2026-68287}
• openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
• dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
• netfilter: nft_inner: Fix IPv6 inner_thoff desync {CVE-2026-46244}
• drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() {CVE-2026-68429}
• crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
• RDMA/rxe: Fix race condition in QP timer handlers {CVE-2026-45910}
• wifi: mac80211: remove station if connection prep fails {CVE-2026-46125}
• tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
• scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk {CVE-2025-38289}
• net/sched: act_ct: Only release RCU read lock after ct_ft {CVE-2026-46319}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• io-wq: check that the predecessor is hashed in io_wq_remove_pending() {CVE-2026-46274}
• wifi: mac80211: drop stray 'static' from fast-RX rx_result {CVE-2026-46152}
• io_uring/poll: fix signed comparison in io_poll_get_ownership() {CVE-2026-52933}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• Bluetooth: btusb: validate Realtek vendor event length {CVE-2026-68339}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
• ipc: limit next_id…

Upstream kernel version 6.18.39 fixes bugs and vulnerabilities. The kmod, bluez, wireless-regdb, firmware and drakx-installer-images packages have been updated to work with this new kernel.

These are all security issues fixed in the kernel-devel-7.1.4-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify: fix…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify: fix…

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.36.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.35.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.34.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.33.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.28.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.26.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.7.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.6.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.5.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.36.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.36.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.4.0-50.2 fixes various security issues:

The following security issues were fixed:

• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).