CVE-2026-63917

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: add VLAN id validation before using

Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID.

Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID.(CVE-2025-71112)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix string copying in parse_apply_sb_mount_options()

strscpy_pad() can't be used to copy a non-NUL-term string into a NUL-term string of possibly bigger size. Commit 0efc5990bca5 ("string.h: Introduce memtostr() and memtostr_pad()") provides additional information in that regard. So if this happens, the following warning is observed:

strnlen: detected buffer overflow: 65 byte read of buffer size 64 WARNING: CPU: 0 PID: 28655 at lib/string_helpers.c:1032 __fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Modules linked in: CPU: 0 UID: 0 PID: 28655 Comm: syz-executor.3 Not tainted 6.12.54-syzkaller-00144-g5f0270f1ba00 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Call Trace: <TASK> __fortify_panic+0x1f/0x30 lib/string_helpers.c:1039 strnlen include/linux/fortify-string.h:235 [inline] sized_strscpy include/linux/fortify-string.h:309 [inline] parse_apply_sb_mount_options fs/ext4/super.c:2504 [inline] __ext4_fill_super fs/ext4/super.c:5261 [inline] ext4_fill_super+0x3c35/0xad00 fs/ext4/super.c:5706 get_tree_bdev_flags+0x387/0x620 fs/super.c:1636 vfs_get_tree+0x93/0x380 fs/super.c:1814 do_new_mount fs/namespace.c:3553 [inline] path_mount+0x6ae/0x1f70 fs/namespace.c:3880 do_mount fs/namespace.c:3893 [inline] __do_sys_mount fs/namespace.c:4103 [inline] __se_sys_mount fs/namespace.c:4080 [inline] __x64_sys_mount+0x280/0x300 fs/namespace.c:4080 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Since userspace is expected to provide s_mount_opts field to be at most 63 characters long with the ending byte being NUL-term, use a 64-byte buffer which matches the size of s_mount_opts, so that strscpy_pad() does its job properly. Return with error if the user still managed to provide a non-NUL-term string here.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-71123)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umad: Reject negative data_len in ib_umad_write

ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list().

Add an explicit check to reject negative data_len before creating the send buffer.

KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80(CVE-2026-23243)

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix memory allocation in nvme_pr_read_keys()

nvme_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for rse via struct_size(). The upper limit is PR_KEYS_MAX (64K).

A malicious or buggy userspace can pass a large num_keys value that results in a 4MB allocation attempt at most, causing a warning in the page allocator when the order exceeds…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

• kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)

• kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

• kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

• kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

• kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

• kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

• kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

• kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

• kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

• kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

• kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

• kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

• kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

• kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

• kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)

• kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

Bug Fix(es) and Enhancement(s):

• [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:Rocky Linux-245035)

• RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)

• [Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255348)

• [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky Linux-10.2.z] (JIRA:Rocky Linux-256731)

• RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

• kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

• kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

• kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

• kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

• kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

• kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

• kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

• kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

• kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

• kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)

• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

• kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

• kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

• kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

• kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

• kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)

• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

• kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)

• kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

• kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

• kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

• kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)

• kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

• kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

• kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

• kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

• kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)

• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

• kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

• kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

• kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

• kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

• kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

• kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)

• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

• kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)

• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)

• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)

• kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)

• kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)

• kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)

• kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)

• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

• kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)

• kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)

• kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

• kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)

• kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)

• kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)

• kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)

• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)

• kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)

• kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)

• kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)

• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)

• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

• kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)

• kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

• kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)

• kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

Bug Fix(es) and Enhancement(s):

• gfs2: filesystem withdrawal rework [rhel-9.8.z] (JIRA:Rocky Linux-252540)

• The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [rhel-9.8.z] (JIRA:Rocky Linux-252544)

• gfs2: Get rid of sd_async_glock_wait [rhel-9.8.z] (JIRA:Rocky Linux-253986)

• [Rocky Linux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255217)

• [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [rhel-9.8.z] (JIRA:Rocky Linux-256733)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
• kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)
• kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
• kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
• kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
• kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
• kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
• kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)
• kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)
• kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
• kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
• kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
• kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
• kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
• kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)
• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
• kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)
• kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

Bug Fix(es) and Enhancement(s):

• [almalinux-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:AlmaLinux-245035)
• RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:AlmaLinux-255233)
• [AlmaLinux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255348)
• [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [AlmaLinux-10.2.z] (JIRA:AlmaLinux-256731)
• RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:AlmaLinux-256890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
• kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
• kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
• kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
• kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
• kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
• kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
• kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
• kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
• kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
• kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
• kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
• kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
• kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
• kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
• kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103)
• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
• kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
• kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
• kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
• kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
• kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920)
• kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
• kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
• kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
• kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
• kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268)
• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
• kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
• kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
• kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
• kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
• kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
• kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172)
• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
• kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
• kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
• kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
• kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
• kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971)
• kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176)
• kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193)
• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
• kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192)
• kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869)
• kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
• kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
• kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176)
• kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174)
• kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175)
• kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
• kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)
• kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200)
• kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128)
• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
• kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102)
• kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298)
• kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003)
• kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243)

Bug Fix(es) and Enhancement(s):

• gfs2: filesystem withdrawal rework [almalinux-9.8.z] (JIRA:AlmaLinux-252540)
• The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [almalinux-9.8.z] (JIRA:AlmaLinux-252544)
• gfs2: Get rid of sd_async_glock_wait [almalinux-9.8.z] (JIRA:AlmaLinux-253986)
• [AlmaLinux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255217)
• [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [almalinux-9.8.z] (JIRA:AlmaLinux-256733)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
• ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}
• ip6: vti: Use ip6_tnl.net in vti6_changelink(). {CVE-2026-63917}
• bpf: Mask pseudo pointer values in verifier logs {CVE-2026-72402}
• drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286}
• wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362}
• gve: fix Rx queue stall on alloc failure {CVE-2026-68129}
• vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
• net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294}
• nbd: restrict sockets to TCP and UDP {CVE-2025-40080}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• scsi: smartpqi: Fix device resources accessed after device removal {CVE-2025-68371}
• cifs: fix oops during encryption {CVE-2022-50341}
• net: qrtr: ns: Limit the maximum server registration per node {CVE-2026-43491}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
• xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
• xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
• xfs: clean up dqblk extraction {CVE-2026-80529}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• bpf: Fix accesses to uninit stack slots {CVE-2023-52452}
• bpf: Allow reads from uninit stack {CVE-2023-52452}
• fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release() {CVE-2023-52731}
• iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() {CVE-2026-68324}
• nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
• Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• net/sched: ets: use old 'nbands' while purging unused classes {CVE-2025-38684}
• net_sched: ets: fix a race in ets_qdisc_change() {CVE-2025-38107}
• fbcon: Fix OOB access in font allocation {CVE-2025-39967}
• fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
• kyber: fix out of bounds access when preempted {CVE-2021-46984}
• padata: Reset next CPU when reorder sequence wraps around {CVE-2025-38584}
• padata: Fix pd UAF once and for all {CVE-2025-38584}
• padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
• xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
• Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-53333}
• nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
• bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
• ALSA: firewire-motu: add bounds check in put_user loop for DSP events {CVE-2025-68753}
• ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events {CVE-2025-68347}
• HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
• HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
• RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
• RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
• cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
• cifs: Fix lost destroy smbd connection when MR allocate failed {CVE-2023-54260}
• cifs: Fix oops due to uncleared server->smbd_conn in reconnect {CVE-2023-53006}
• PCI/ASPM:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Root has patched CVE-2026-63917 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify: fix…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify: fix…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.37.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.36.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.35.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.34.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.33.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.28.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.26.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).