CVE-2026-63983

• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2025-39827
  • net: rose: include node references in rose_neigh refcount {CVE-2025-39827}
• CVE-2026-93140
  • udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
• CVE-2026-90112
  • net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
• CVE-2026-90237
  • netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237}
• CVE-2026-93051
  • misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051}
• CVE-2026-90379
  • wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90383
  • misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-93047
  • drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047}
• CVE-2026-93192
  • drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192}
• CVE-2026-93050
  • ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050}
• CVE-2026-90311
  • thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311}
• CVE-2026-93191
  • smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191}
• CVE-2026-93042
  • dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042}
• CVE-2026-93056
  • usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
• CVE-2026-93203
  • batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203}
• CVE-2026-93204
  • batman-adv: dat: atomically update mac addresses {CVE-2026-93204}
• CVE-2026-90000
  • HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-93202
  • i3c: master: Fix recursive locking during device registration {CVE-2026-93202}
• CVE-2026-90347
  • arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347}
• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-92500
  • ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}
• CVE-2026-93196
  • nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
• CVE-2026-90207
  • ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-90110
  • inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110}
• CVE-2026-90293
  • IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
• CVE-2026-89838
  • f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
• CVE-2026-93177
  • drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177}
• CVE-2026-89823
  • drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
• CVE-2026-90041
  • HID: sony: clean up device list on probe failure {CVE-2026-90041}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-93095 -…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
• wifi: libipw: reject too-short association responses {CVE-2026-98348}
• net: lock the socket in sock_gettstamp() {CVE-2026-98276}
• ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
• wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
• wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• ALSA: usb-audio: fix OOB write in…

• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
• wifi: libipw: reject too-short association responses {CVE-2026-98348}
• net: lock the socket in sock_gettstamp() {CVE-2026-98276}
• ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
• wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
• wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• ALSA: usb-audio: fix OOB write in…

• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492}
• ocfs2: validate dx_root extent list fields during block read {CVE-2026-89492}
• nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}
• packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582}
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header {CVE-2026-80731}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404}
• net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants {CVE-2026-72390}
• net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390}
• Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
• NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476}
• sctp: distinguish sequence zero from wildcard in reconf lookup {CVE-2026-89476}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• net: Introduce skb tc depth field to track packet loops {CVE-2026-63983}
• netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• scsi: xen: scsiback: Free unsubmitted command instead of double-putting it {CVE-2026-72085}
• ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
• IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget {CVE-2026-89674}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• nvmet-tcp: fix race between ICReq handling and queue teardown {CVE-2026-46135}
• ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090}
• ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984}
• bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• mt76: fix per-driver wcid range checks after wcid array size bump {CVE-2022-49328}
• af_unix: Fix UAF read of…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• net: Introduce skb tc depth field to track packet loops {CVE-2026-63983}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• ata: libata-core: Reject an invalid concurrent positioning ranges count {CVE-2026-72030}
• wifi: mac80211: validate extension-frame layout before RX {CVE-2026-68470}
• wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() {CVE-2026-68470}
• drm/amd/pm: fix pptable use-after-free {CVE-2026-74450}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: clear ce->tgthint in free_tgts() {CVE-2026-89636}
• smb: client: harden DFS cache against invalid target hints {CVE-2026-93210}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• HID: sony: clean up device list on probe failure {CVE-2026-90041}
• drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
• hwrng: core - fix rng list on registration error {CVE-2026-93163}
• RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104}
• fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() {CVE-2026-93100}
• bpf: Fix potential UAF when reading bpf link info {CVE-2026-90392}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171}
• netfilter: cttimeout: prevent UAF during module unload {CVE-2026-97609}
• thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367}
• ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312}
• scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887}
• scsi: target: Fix hexadecimal CHAP_I handling {CVE-2026-63886}
• scsi: target: iscsi: Validate CHAP_R length before base64 decode {CVE-2026-63886}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• nfsd: RCU-protect cl_cb_session to fix…

• net: bridge: fix vlan tunnel dst refcnt when egressing {CVE-2021-47222}
• net: bridge: fix vlan tunnel dst null pointer dereference {CVE-2021-47223}
• writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378}
• writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
• writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
• fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount {CVE-2026-64378}
• libceph: validate banner payload length {CVE-2026-90067}
• drm/virtio: release the GEM object on virtio_gpu_vram_create() errors {CVE-2026-98606}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs {CVE-2026-74390}
• nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685}
• vdpa_sim_blk: reject out-of-range sector starts {CVE-2026-97991}
• Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
• HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
• nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482}
• nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386}
• bpf: mark a NULL call argument precise {CVE-2026-98019}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get {CVE-2026-72262}
• ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes() {CVE-2026-72262}
• Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• fs/resctrl: Fix UAF from worker threads when domains are removed {CVE-2026-93099}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
• openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• sctp: diag: reject stale associations in dump_one path {CVE-2026-52917}
• sctp: Hold sock lock while iterating over address list {CVE-2026-52917}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• nfsd: gate nfs3…

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix packet loop on netem when duplicate is on

When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted.

The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but that does not cover all cases because it is per-qdisc state shared across all concurrent enqueue paths and is not safe without additional locking.

Use the skb tc_depth field introduced in an earlier patch:

• increment it on the duplicate before re-enqueue
• skip duplication for any skb whose tc_depth is already non-zero.

This marks the packet itself rather than mutating qdisc state, therefore it is safe regardless of tree topology or concurrency.

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted. The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but that does not cover all cases because it is per-qdisc state shared across all concurrent enqueue paths and is not safe without additional locking. Use the skb tc_depth field introduced in an earlier patch: - increment it on the duplicate before re-enqueue - skip duplication for any skb whose tc_depth is already non-zero. This marks the packet itself rather than mutating qdisc state, therefore it is safe regardless of tree topology or concurrency.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

Root has patched CVE-2026-63983 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-63983 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-63983 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (bsc#1274008).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
• CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
• CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (bsc#1274008).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
• CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
• CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (bsc#1274008).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
• CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
• CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (bsc#1274008).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
• CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
• CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2023-54158: btrfs: don't free qgroup space unless specified (bsc#1256076).
• CVE-2023-54180: btrfs: handle case when repair happens with dev-replace (bsc#1255995).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-63948: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (bsc#1272670).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64456: hwrng: virtio: clamp device-reported used.len at copy_data() (bsc#1273288).
• CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).
• CVE-2026-68106: drm/amdgpu: fix division by zero with invalid uvd dimensions (bsc#1274853).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68236: drm/amd/display: set new_stream to NULL after release (bsc#1275659).
• CVE-2026-68303: drm/vc4: hvs/v3d: Fix null dereference in unbind (bsc#1275080).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-68430: drm/amdgpu/gfx8: drop unecessary BUG_ON() (bsc#1276273).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72319: ipvs: ensure inner headers in ICMP errors are in headroom (bsc#1275964).
• CVE-2026-72476: dmaengine: Fix possible use after free (bsc#1276844).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74408: wifi: ath9k: fix OOB access from firmware tx status queue ID (bsc#1276387).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74675: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (bsc#1278313).
• CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
• CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
• CVE-2026-89726: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (bsc#1281058).
• CVE-2026-89778: isofs: fix out-of-bounds page array access on empty zisofs block (bsc#1280966).
• CVE-2026-89987: mm/huge_memory: transfer the pmd dirty bit to the folio on zap (bsc#1281819).
• CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
• CVE-2026-90283: hugetlbfs: release subpool on fill_super failure (bsc#1281771).
• CVE-2026-93252: ocfs2: make ocfs2_set_acl() static (bsc#1282784).
• CVE-2026-93287: i2c: smbus: reject oversized block transfers in the common path (bsc#1282744).
• CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).
• CVE-2026-93820: PCI: rockchip: Protect root bus removal with rescan lock (bsc#1282755).
• CVE-2026-93822: PCI: iproc: Protect root bus removal with rescan lock (bsc#1282762).
• CVE-2026-97416: btrfs: balance: fix potential…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587:…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889). -…

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• PSP security protocol;
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Intel NPU Driver;
• Compute Acceleration Framework;
• ACPI drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NVME drivers;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• Power supply drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• S/390 drivers;
• SCSI subsystem;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• TI TPS6598x USB Power Delivery controller driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Framebuffer layer;
• TSM AMD SEV Guest driver;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• HugeTLB file system;
• Network file systems library;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Overlay file system;
• Diskquota system;
• SMB network file system;
• Tracing file system;
• UDF file system;
• DRM TTM subsystem;
• Control group (cgroup);
• Kernel CPU control infrastructure;
• Tracing infrastructure;
• QorIQ DPAA2 FSL-MC bus driver;
• Freescale ENETC Ethernet drivers;
• Memory management;
• Memory Management;
• Linked list library;
• Netfilter;
• padata…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• PSP security protocol;
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Intel NPU Driver;
• Compute Acceleration Framework;
• ACPI drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• IOMMU subsystem;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• IBM Advanced System Management driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• Device tree and open firmware driver;
• Parport drivers;
• PCI subsystem;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• Power supply drivers;
• Remote Processor subsystem;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• S/390 drivers;
• SCSI subsystem;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• TI TPS6598x USB Power Delivery controller driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Framebuffer layer;
• TSM AMD SEV Guest driver;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• HugeTLB file system;
• Journaling layer for block devices (JBD2);
• Network file systems…

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• Cryptographic API;
• PSP security protocol;
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Intel NPU Driver;
• Compute Acceleration Framework;
• ACPI drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NVME drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• Power supply drivers;
• Voltage and Current Regulator drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• S/390 drivers;
• SCSI subsystem;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• TI TPS6598x USB Power Delivery controller driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Framebuffer layer;
• TSM AMD SEV Guest driver;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• HugeTLB file system;
• Network file systems library;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Overlay file system;
• Diskquota system;
• SMB network file system;
• Tracing file system;
• UDF file system;
• DRM TTM subsystem;
• Control group (cgroup);
• Kernel CPU control infrastructure;
• Tracing infrastructure;
• QorIQ DPAA2 FSL-MC bus driver;
• Freescale ENETC Ethernet drivers; -…

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• Cryptographic API;
• PSP security protocol;
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Intel NPU Driver;
• Compute Acceleration Framework;
• ACPI drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NVME drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• Power supply drivers;
• Voltage and Current Regulator drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• S/390 drivers;
• SCSI subsystem;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• TI TPS6598x USB Power Delivery controller driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Framebuffer layer;
• TSM AMD SEV Guest driver;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• HugeTLB file system;
• Network file systems library;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Overlay file system;
• Diskquota system;
• SMB network file system;
• Tracing file system;
• UDF file system;
• DRM TTM subsystem;
• Control group (cgroup);
• Kernel CPU control infrastructure;
• Tracing infrastructure;
• QorIQ DPAA2 FSL-MC bus driver;
• Freescale ENETC Ethernet drivers; -…

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• Cryptographic API;
• PSP security protocol;
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Intel NPU Driver;
• Compute Acceleration Framework;
• ACPI drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• I3C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NVME drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• Power supply drivers;
• Voltage and Current Regulator drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• S/390 drivers;
• SCSI subsystem;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• TI TPS6598x USB Power Delivery controller driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Framebuffer layer;
• TSM AMD SEV Guest driver;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• HugeTLB file system;
• Network file systems library;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Overlay file system;
• Diskquota system;
• SMB network file system;
• Tracing file system;
• UDF file system;
• DRM TTM subsystem;
• Control group (cgroup);
• Kernel CPU control infrastructure;
• Tracing infrastructure;
• QorIQ DPAA2 FSL-MC bus driver;
• Freescale ENETC Ethernet drivers; -…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• ARM64 architecture;
• Cryptographic API;
• PSP security protocol;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• System reset/shutdown drivers;
• Power sequencing drivers;
• Power supply drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• ARM64 architecture;
• Cryptographic API;
• PSP security protocol;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• System reset/shutdown drivers;
• Power sequencing drivers;
• Power supply drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB…

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 platform drivers;
• ARM64 architecture;
• Cryptographic API;
• PSP security protocol;
• User-space API (UAPI);
• Kernel build system;
• ARM32 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Compute Acceleration Framework;
• Intel NPU Driver;
• ACPI drivers;
• Android drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DPLL subsystem;
• EDAC drivers;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• FWCTL subsystem;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• ACPI WMI driver;
• Generic PM domains;
• MediaTek PM domains;
• System reset/shutdown drivers;
• Power sequencing drivers;
• Power supply drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• MPAM driver;
• Amlogic Meson reset controller drivers;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• NVIDIA Tegra Control Backbone (CBB) driver;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• DesignWare USB2 driver;
• DesignWare USB3 driver;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB ChaosKey driver;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB…