CVE-2026-64448

smb: client: restrict implied bcc[0] exemption to responses without data area

8.2 HighFix available

What does this mean?

: 8.2v3.1, from CVE List
: 0.46%40th percentile
Fixed in: 6.6.145.2-1kernel
Published: July 25, 2026
Modified: November 10, 2026
Weakness: CWE-125
Also known as: AZL-93782BELL-CVE-2026-64448CLSA-2026-1789037015CLSA-2026-1789039259CLSA-2026-1789039867CLSA-2026-1789898700CLSA-2026-1789958474CLSA-2026-1791800936
Show 46 moreShow less
CLSA-2026-1791852988CLSA-2026-1791858083CLSA-2026-1792239979CLSA-2026-1792753425CLSA-2026-1792980237DEBIAN-CVE-2026-64448EUVD-2026-48792GHSA-36gp-77hh-hxwmOESA-2026-3704ROOT-OS-DEBIAN-12-CVE-2026-64448ROOT-OS-UBUNTU-2204-CVE-2026-64448SUSE-SU-2026:23477-1SUSE-SU-2026:23481-1SUSE-SU-2026:23528-1SUSE-SU-2026:23529-1SUSE-SU-2026:24179-1SUSE-SU-2026:24184-1SUSE-SU-2026:24197-1SUSE-SU-2026:24235-1SUSE-SU-2026:4120-1SUSE-SU-2026:4254-1SUSE-SU-2026:4687-1UBUNTU-CVE-2026-64448USN-8726-1USN-8726-2USN-8726-3USN-8726-4USN-8727-1USN-8728-1USN-8728-2USN-8728-3USN-8760-1USN-8760-2USN-8800-1USN-8875-1USN-8875-2USN-8876-1USN-8877-1USN-8878-1USN-8879-1USN-8886-1USN-8917-1USN-8918-1USN-8963-1openSUSE-SU-2026:11476-1openSUSE-SU-2026:22091-1

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restrict implied bcc[0] exemption to responses without data area

smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received ("server can return one byte more due to implied bcc[0]"). This was introduced to accommodate servers that omit the trailing bcc[0] overlap byte when no data area is present.

However, the exemption is applied unconditionally, regardless of whether the command actually carries a data area (has_smb2_data_area[]). When a response with a data area is subject to the +1 exemption, the reported data can extend one byte beyond the bytes actually received, yet smb2_check_message() still accepts it. The subsequent decoder then reads past the end of the receive buffer. This is reachable during NEGOTIATE and SESSION_SETUP, before the session is established.

The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected:

BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00 Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81 CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1 Call Trace: <TASK> dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 asn1_ber_decoder+0x16a7/0x1b00 decode_negTokenInit+0x19/0x30 SMB2_negotiate+0x31d9/0x4c90 cifs_negotiate_protocol+0x1f2/0x3f0 cifs_get_smb_ses+0x93f/0x17e0 cifs_mount_get_session+0x7f/0x3a0 cifs_mount+0xb4/0xcf0 cifs_smb3_do_mount+0x23a/0x1500 smb3_get_tree+0x3b0/0x630 vfs_get_tree+0x82/0x2d0 fc_mount+0x10/0x1b0 path_mount+0x50d/0x1de0 __x64_sys_mount+0x20b/0x270 do_syscall_64+0xee/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 85: kmem_cache_alloc_noprof+0x106/0x380 mempool_alloc_noprof+0x116/0x1e0 cifs_small_buf_get+0x31/0x80 allocate_buffers+0x10d/0x2b0 cifs_demultiplex_thread+0x1d5/0x1d50 kthread+0x2c6/0x390 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30 The buggy address is located 0 bytes to the right of allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0) which belongs to the cache cifs_small_rq of size 448

BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50 Read of size 329 at addr ffff88800726c678 by task mount.cifs/89 CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1 Call Trace: <TASK> dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 __asan_memcpy+0x23/0x60 kmemdup_noprof+0x36/0x50 decode_ntlmssp_challenge+0x457/0x680 SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0 SMB2_sess_setup+0x219/0x4f0 cifs_setup_session+0x248/0xaf0 cifs_get_smb_ses+0xf79/0x17e0 cifs_mount_get_session+0x7f/0x3a0 cifs_mount+0xb4/0xcf0 cifs_smb3_do_mount+0x23a/0x1500 smb3_get_tree+0x3b0/0x630 vfs_get_tree+0x82/0x2d0 fc_mount+0x10/0x1b0 path_mount+0x50d/0x1de0 __x64_sys_mount+0x20b/0x270 do_syscall_64+0xee/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 93: kmem_cache_alloc_noprof+0x106/0x380 mempool_alloc_noprof+0x116/0x1e0 cifs_small_buf_get+0x31/0x80 allocate_buffers+0x10d/0x2b0 cifs_demultiplex_thread+0x1d5/0x1d50 kthread+0x2c6/0x390 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30 The buggy address is located 120 bytes inside of allocated 448-byte region [ffff88800726c600, ffff88800726c7c0) which belongs to the cache cifs_small_rq of size 448

Restrict the +1 exemption to responses that have no data area, so that it still covers the bcc[0] omission it was meant for. When a data area is present, the +1 discrepancy instead means the reported data length overruns the ---truncated---

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: High

Exploit likelihood

0.46%Up 0.2 points since Jul 25, 2026

What each source reports

CVE List Score used 8.2

smb: client: restrict implied bcc[0] exemption to responses without data area

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restrict implied bcc[0] exemption to responses without data area

The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected:

Record: CVE-2026-64448
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

EUVDEUVD-2026-48792 8.2

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restrict implied bcc[0] exemption to responses without data area

The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected:

Record: EUVD-2026-48792
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-36gp-77hh-hxwm 8.2

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict...

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restrict implied bcc[0] exemption to responses without data area

The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected:

Record: GHSA-36gp-77hh-hxwm
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD 8.2

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restrict implied bcc[0] exemption to responses without data area

The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected:

Record: CVE-2026-64448
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVBELL-CVE-2026-64448 8.2

Record: BELL-CVE-2026-64448
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSV 8.2

smb: client: restrict implied bcc[0] exemption to responses without data area

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restrict implied bcc[0] exemption to responses without data area

The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected:

Record: CVE-2026-64448
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

Show 48 moreShow less

OSVDEBIAN-CVE-2026-64448 8.2

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without data area smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received ("server can return one byte more due to implied bcc[0]"). This was introduced to accommodate servers that omit the trailing bcc[0] overlap byte when no data area is present. However, the exemption is applied unconditionally, regardless of whether the command actually carries a data area (has_smb2_data_area[]). When a response with a data area is subject to the +1 exemption, the reported data can extend one byte beyond the bytes actually received, yet smb2_check_message() still accepts it. The subsequent decoder then reads past the end of the receive buffer. This is reachable during NEGOTIATE and SESSION_SETUP, before the session is established. The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected: BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00 Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81 CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1 Call Trace: <TASK> dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 asn1_ber_decoder+0x16a7/0x1b00 decode_negTokenInit+0x19/0x30 SMB2_negotiate+0x31d9/0x4c90 cifs_negotiate_protocol+0x1f2/0x3f0 cifs_get_smb_ses+0x93f/0x17e0 cifs_mount_get_session+0x7f/0x3a0 cifs_mount+0xb4/0xcf0 cifs_smb3_do_mount+0x23a/0x1500 smb3_get_tree+0x3b0/0x630 vfs_get_tree+0x82/0x2d0 fc_mount+0x10/0x1b0 path_mount+0x50d/0x1de0 __x64_sys_mount+0x20b/0x270 do_syscall_64+0xee/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 85: kmem_cache_alloc_noprof+0x106/0x380 mempool_alloc_noprof+0x116/0x1e0 cifs_small_buf_get+0x31/0x80 allocate_buffers+0x10d/0x2b0 cifs_demultiplex_thread+0x1d5/0x1d50 kthread+0x2c6/0x390 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30 The buggy address is located 0 bytes to the right of allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0) which belongs to the cache cifs_small_rq of size 448 BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50 Read of size 329 at addr ffff88800726c678 by task mount.cifs/89 CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1 Call Trace: <TASK> dump_stack_lvl+0x4e/0x70 print_report+0x157/0x4c9 kasan_report+0xce/0x100 kasan_check_range+0x10f/0x1e0 __asan_memcpy+0x23/0x60 kmemdup_noprof+0x36/0x50 decode_ntlmssp_challenge+0x457/0x680 SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0 SMB2_sess_setup+0x219/0x4f0 cifs_setup_session+0x248/0xaf0 cifs_get_smb_ses+0xf79/0x17e0 cifs_mount_get_session+0x7f/0x3a0 cifs_mount+0xb4/0xcf0 cifs_smb3_do_mount+0x23a/0x1500 smb3_get_tree+0x3b0/0x630 vfs_get_tree+0x82/0x2d0 fc_mount+0x10/0x1b0 path_mount+0x50d/0x1de0 __x64_sys_mount+0x20b/0x270 do_syscall_64+0xee/0x590 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Allocated by task 93: kmem_cache_alloc_noprof+0x106/0x380 mempool_alloc_noprof+0x116/0x1e0 cifs_small_buf_get+0x31/0x80 allocate_buffers+0x10d/0x2b0 cifs_demultiplex_thread+0x1d5/0x1d50 kthread+0x2c6/0x390 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30 The buggy address is located 120 bytes inside of allocated 448-byte region [ffff88800726c600, ffff88800726c7c0) which belongs to the cache cifs_small_rq of size 448 Restrict the +1 exemption to responses that have no data area, so that it still covers the bcc[0] omission it was meant for. When a data area is present, the +1 discrepancy instead means the reported data length overruns the ---truncated---

Record: DEBIAN-CVE-2026-64448
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-3704 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: add VLAN id validation before using

Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID.

Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID.(CVE-2025-71112)

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix string copying in parse_apply_sb_mount_options()

strscpy_pad() can't be used to copy a non-NUL-term string into a NUL-term string of possibly bigger size. Commit 0efc5990bca5 ("string.h: Introduce memtostr() and memtostr_pad()") provides additional information in that regard. So if this happens, the following warning is observed:

strnlen: detected buffer overflow: 65 byte read of buffer size 64 WARNING: CPU: 0 PID: 28655 at lib/string_helpers.c:1032 __fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Modules linked in: CPU: 0 UID: 0 PID: 28655 Comm: syz-executor.3 Not tainted 6.12.54-syzkaller-00144-g5f0270f1ba00 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__fortify_report+0x96/0xc0 lib/string_helpers.c:1032 Call Trace: <TASK> __fortify_panic+0x1f/0x30 lib/string_helpers.c:1039 strnlen include/linux/fortify-string.h:235 [inline] sized_strscpy include/linux/fortify-string.h:309 [inline] parse_apply_sb_mount_options fs/ext4/super.c:2504 [inline] __ext4_fill_super fs/ext4/super.c:5261 [inline] ext4_fill_super+0x3c35/0xad00 fs/ext4/super.c:5706 get_tree_bdev_flags+0x387/0x620 fs/super.c:1636 vfs_get_tree+0x93/0x380 fs/super.c:1814 do_new_mount fs/namespace.c:3553 [inline] path_mount+0x6ae/0x1f70 fs/namespace.c:3880 do_mount fs/namespace.c:3893 [inline] __do_sys_mount fs/namespace.c:4103 [inline] __se_sys_mount fs/namespace.c:4080 [inline] __x64_sys_mount+0x280/0x300 fs/namespace.c:4080 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Since userspace is expected to provide s_mount_opts field to be at most 63 characters long with the ending byte being NUL-term, use a 64-byte buffer which matches the size of s_mount_opts, so that strscpy_pad() does its job properly. Return with error if the user still managed to provide a non-NUL-term string here.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.(CVE-2025-71123)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umad: Reject negative data_len in ib_umad_write

ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list().

Add an explicit check to reject negative data_len before creating the send buffer.

KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80(CVE-2026-23243)

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix memory allocation in nvme_pr_read_keys()

nvme_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for rse via struct_size(). The upper limit is PR_KEYS_MAX (64K).

A malicious or buggy userspace can pass a large num_keys value that results in a 4MB allocation attempt at most, causing a warning in the page allocator when the order exceeds…

Record: OESA-2026-3704
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-64448 0.0

Record: UBUNTU-CVE-2026-64448
CVSS 4.0: 0.0 NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-10

OSVAZL-93782 No score

CVE-2026-64448 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved:

smb: client: restrict implied bcc[0] exemption to responses without data area

The resulting out-of-bounds reads are visible under KASAN when mounting against a non-conforming server; both the SPNEGO/negTokenInit and the NTLMSSP challenge decoders are affected:

Record: AZL-93782
Updated: 2026-11-02

OSVCLSA-2026-1789037015 No score

kernel: Fix of 51 CVEs

net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
usb: free iso schedules on failed submit {CVE-2026-64348}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
netfilter: ebtables: zero chainstack array {CVE-2026-64413}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

Record: CLSA-2026-1789037015
Updated: 2026-11-02

OSVCLSA-2026-1789039259 No score

kernel: Fix of 51 CVEs

net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
usb: free iso schedules on failed submit {CVE-2026-64348}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
netfilter: ebtables: zero chainstack array {CVE-2026-64413}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

Record: CLSA-2026-1789039259
Updated: 2026-11-02

OSVCLSA-2026-1789039867 No score

kernel: Fix of 51 CVEs

net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
usb: free iso schedules on failed submit {CVE-2026-64348}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
netfilter: ebtables: zero chainstack array {CVE-2026-64413}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

Record: CLSA-2026-1789039867
Updated: 2026-11-02

OSVCLSA-2026-1789898700 No score

kernel: Fix of 163 CVEs

drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251}
amd/amdkfd: sync all devices to wait all processes being evicted {CVE-2024-36949}
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted {CVE-2024-36909}
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl {CVE-2024-36912}
xfs: save ailp before dropping the AIL lock in push callbacks {CVE-2026-31454}
net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak {CVE-2026-43041}
netfilter: nf_conntrack: destroy stale expectfn expectations on unregister {CVE-2026-53349}
cifs: avoid NULL pointer dereference in dbg call {CVE-2025-37844}
fs/notify: call exportfs_encode_fid with s_umount {CVE-2025-40237}
cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258}
pstore/ram: fix buffer overflow in persistent_ram_save_old() {CVE-2026-46253}
Bluetooth: ISO: fix iso_conn related locking and validity issues {CVE-2023-54164}
netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873}
ext4: always drain queued discard work in ext4_mb_release() {CVE-2026-43065}
ipvs: Defer ip_vs_ftp unregister during netns cleanup {CVE-2025-40018}
Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto {CVE-2025-40281}
fscache: Use wait_on_bit() to wait for the freeing of relinquished volume {CVE-2023-52982}
libceph: prevent potential out-of-bounds reads in process_message_header() {CVE-2026-43406}
netfilter: nf_tables: reject immediate NF_QUEUE verdict {CVE-2026-43024}
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() {CVE-2025-68261}
bpf, sockmap: Fix af_unix iter deadlock {CVE-2026-53035}
sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
netfilter: xt_CT: drop pending enqueued packets on template removal {CVE-2026-23391}
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457}
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407}
af_unix: read UNIX_DIAG_VFS data under unix_state_lock {CVE-2026-31673}
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted {CVE-2025-68337}
Bluetooth: Fix NULL pointer deference on eir_get_service_data {CVE-2025-38304}
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption {CVE-2026-31533}
fsnotify: do not generate ACCESS/MODIFY events on child for special files {CVE-2025-68788}
isofs: validate Rock Ridge CE continuation extent against volume size {CVE-2026-46303}
net: strparser: fix skb_head leak in strp_abort_strp() {CVE-2026-46102}
sctp: fix uninit-value in __sctp_rcv_asconf_lookup() {CVE-2026-53225}
xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
bpf: tcp: fix double sock release on batch realloc {CVE-2026-64575}
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714}
bpf: tcp: Avoid socket skips and repeats during iteration {CVE-2026-74714}
bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items {CVE-2026-74714}
bpf: tcp: Get rid of st_bucket_done {CVE-2026-74714}
bpf: tcp: Make sure iter->batch always contains a full bucket snapshot {CVE-2026-64575}
bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch {CVE-2026-74714}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689}
net: add copy_safe_from_sockptr() helper {CVE-2026-74689}
xfs: close crash window in attr dabtree…

Record: CLSA-2026-1789898700
Updated: 2026-11-02

OSVCLSA-2026-1789958474 No score

Fix of 167 CVEs

CVE-2025-39826
- net: rose: convert 'use' field to refcount_t {CVE-2025-39826}
CVE-2025-40146
- blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
CVE-2024-53216
- nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
CVE-2026-89778
- isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
CVE-2026-23050
- pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
CVE-2025-68796
- f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796}
CVE-2025-68330
- iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
CVE-2025-40333
- f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
CVE-2025-40160
- xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
CVE-2023-54047
- drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
CVE-2025-68190
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
CVE-2025-68188
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
CVE-2026-89786
- ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
CVE-2022-50764
- ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
CVE-2026-80785
- fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
CVE-2026-80788
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788}
CVE-2026-80747
- drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}
CVE-2026-80907
- drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
CVE-2026-80908
- drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
CVE-2026-80812
- ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
CVE-2026-80948
- wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
CVE-2025-40137
- f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
CVE-2023-54150
- drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
CVE-2026-89784
- SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
CVE-2026-89783
- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
CVE-2026-89780
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780}
CVE-2026-89777
- vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777}
CVE-2026-89789
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
CVE-2025-68797
- char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
CVE-2025-68767
- hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
CVE-2026-63961
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961}
CVE-2026-63904
- usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
CVE-2022-50864
- nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
CVE-2025-68771
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
CVE-2025-68750
- usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
CVE-2026-80909
- drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909}
CVE-2026-74402
- crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} *…

Record: CLSA-2026-1789958474
Updated: 2026-11-02

OSVCLSA-2026-1791800936 No score

kernel: Fix of 191 CVEs

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818}
drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199}
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199}
drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230}
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230}
openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165}
openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678}
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs {CVE-2026-74642}
ALSA: usb-audio: fix use-after-free in ump_to_endpoint() {CVE-2026-74501}
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
exec: do_close_on_exec() before taking exec_update_lock {CVE-2026-64371}
proc: Fix broken error paths for namespace links {CVE-2026-64371}
proc: protect ptrace_may_access() with exec_update_lock (part 1) {CVE-2026-64371}
ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes {CVE-2026-74503}
ALSA: timer: Forcibly close timer instances at closing {CVE-2026-53193}
usb: typec: ucsi: Fix race condition and ordering in port unregistration {CVE-2026-74441}
arp: do not assume dev_hard_header() does not change skb->head {CVE-2026-22988}
netfilter: nft_ct: fix use-after-free in timeout object destroy {CVE-2026-31665}
md/raid10: fix writes_pending and barrier reference leaks on discard failures {CVE-2026-72438}
md/raid10: fix deadlock with check operation and nowait requests {CVE-2026-46050}
mm: introduce and use {pgd,p4d}_populate_kernel() {CVE-2025-39844}
vsock/virtio: fix zerocopy completion for multi-skb sends {CVE-2026-53365}
vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting {CVE-2026-52994}
mm: do file ownership checks with the proper mount idmap {CVE-2026-64294}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths {CVE-2026-45870}
Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig {CVE-2026-53208}
slip: bound decode() reads against the compressed packet length {CVE-2026-45843}
net: tls: fix strparser anchor skb leak on offload RX setup failure {CVE-2026-52974}
netfilter: nf_tables: unconditionally bump set->nelems before insertion {CVE-2026-23272}
rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131}
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() {CVE-2026-23458}
mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr {CVE-2025-21938}
bpf: Fix NULL deref in map_kptr_match_type for scalar regs {CVE-2026-53032}
bpf: Explicitly check accesses to bpf_sock_addr {CVE-2025-40078}
nexthop: Forbid FDB status change while nexthop is in a group {CVE-2025-39980}
bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN {CVE-2026-31525}
x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() {CVE-2025-21913}
ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() {CVE-2024-57994}
drm/i915/vrr: require valid min/max vfreq for VRR {CVE-2026-68254}
libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954}
gfs2: prevent NULL pointer dereference during unmount {CVE-2026-53048}
smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path {CVE-2026-31708}
ext4: reject mount if bigalloc with s_first_data_block != 0 {CVE-2026-31447}
NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324}
netfilter: x_tables: guard option walkers against 1-byte tail reads {CVE-2026-43452}
smb: client: Fix refcount leak for cifs_sb_tlink {CVE-2025-40103}
smb: client: harden POSIX SID length parsing {CVE-2026-64380}
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
bpf: Allow LPM map access from sleepable…

Record: CLSA-2026-1791800936
Updated: 2026-11-02

OSVCLSA-2026-1791852988 No score

kernel: Fix of 107 CVEs

netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
sctp: validate embedded address parameter length {CVE-2026-74287}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
smb: client: reject overlapping data areas in SMB2 responses {CVE-2026-64257}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
crypto: qat - protect interrupt mask CSRs with a spinlock {CVE-2026-64438}
crypto: qat - remove intermediate tasklet for vf2pf {CVE-2026-64438}
usb: free iso schedules on failed submit {CVE-2026-64348}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
net: tun: bound receive headroom {CVE-2026-81000}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
wifi: ath9k: hif_usb: don't dereference hif_dev after…

Record: CLSA-2026-1791852988
Updated: 2026-11-02

OSVCLSA-2026-1791858083 No score

kernel: Fix of 94 CVEs

netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
usb: free iso schedules on failed submit {CVE-2026-64348}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
net: tun: bound receive headroom {CVE-2026-81000}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet…

Record: CLSA-2026-1791858083
Updated: 2026-11-02

OSVCLSA-2026-1792239979 No score

kernel: Fix of 73 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}
ip6: vti: Use ip6_tnl.net in vti6_changelink(). {CVE-2026-63917}
bpf: Mask pseudo pointer values in verifier logs {CVE-2026-72402}
drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286}
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362}
gve: fix Rx queue stall on alloc failure {CVE-2026-68129}
vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294}
nbd: restrict sockets to TCP and UDP {CVE-2025-40080}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
scsi: smartpqi: Fix device resources accessed after device removal {CVE-2025-68371}
cifs: fix oops during encryption {CVE-2022-50341}
net: qrtr: ns: Limit the maximum server registration per node {CVE-2026-43491}
mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
xfs: clean up dqblk extraction {CVE-2026-80529}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
bpf: Fix accesses to uninit stack slots {CVE-2023-52452}
bpf: Allow reads from uninit stack {CVE-2023-52452}
fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release() {CVE-2023-52731}
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() {CVE-2026-68324}
nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
net/sched: ets: use old 'nbands' while purging unused classes {CVE-2025-38684}
net_sched: ets: fix a race in ets_qdisc_change() {CVE-2025-38107}
fbcon: Fix OOB access in font allocation {CVE-2025-39967}
fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
kyber: fix out of bounds access when preempted {CVE-2021-46984}
padata: Reset next CPU when reorder sequence wraps around {CVE-2025-38584}
padata: Fix pd UAF once and for all {CVE-2025-38584}
padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-53333}
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
ALSA: firewire-motu: add bounds check in put_user loop for DSP events {CVE-2025-68753}
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events {CVE-2025-68347}
HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
cifs: Fix lost destroy smbd connection when MR allocate failed {CVE-2023-54260}
cifs: Fix oops due to uncleared server->smbd_conn in reconnect {CVE-2023-53006}
PCI/ASPM:…

Record: CLSA-2026-1792239979
Updated: 2026-11-02

OSVCLSA-2026-1792753425 No score

kernel-uek: Fix of 6 CVEs

net: skbuff: propagate shared-frag marker in skb_zerocopy()
net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
netfilter: conntrack: remove sprintf usage {CVE-2026-53002}

Record: CLSA-2026-1792753425
Updated: 2026-11-02

OSVCLSA-2026-1792980237 No score

Fix of 276 CVEs

CVE-2022-49416
- wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
CVE-2022-49685
- iio: trigger: sysfs: fix use-after-free on remove {CVE-2022-49685}
CVE-2021-47670
- can: peak_usb: fix use after free bugs {CVE-2021-47670}
CVE-2026-98706
- wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
CVE-2026-98610
- net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
CVE-2026-98548
- sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
CVE-2026-98614
- sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
CVE-2026-98547
- af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
CVE-2026-98579
- nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure {CVE-2026-98579}
CVE-2026-98581
- nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() {CVE-2026-98581}
CVE-2026-98577
- nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
CVE-2026-98482
- nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
CVE-2026-98576
- nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
CVE-2026-98624
- netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
- netlink: use blocking notifier {CVE-2026-98624}
CVE-2026-98794
- ipvs: filter some flags received in the backup server {CVE-2026-98794}
CVE-2026-98829
- wifi: mac80211: drop oversized fragments to avoid extra_len overflow {CVE-2026-98829}
CVE-2026-98708
- wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708}
CVE-2026-98707
- wifi: mac80211: shut down RX BA session timer on teardown {CVE-2026-98707}
CVE-2026-98532
- ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
CVE-2026-98541
- fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
CVE-2026-98461
- Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461}
CVE-2026-98621
- net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
CVE-2026-98526
- llc: reserve device headroom for allocated frames {CVE-2026-98526}
CVE-2026-98555
- llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
CVE-2026-98573
- net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
CVE-2026-98739
- Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}
CVE-2026-98457
- Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
CVE-2026-98460
- Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
CVE-2026-98856
- kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856}
CVE-2026-98636
- squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
CVE-2026-98681
- smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681}
CVE-2026-98771
- usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
CVE-2026-98772
- USB: serial: fix port tear down use-after-free {CVE-2026-98772}
CVE-2026-98696
- USB: serial: fix driver deregistration order {CVE-2026-98696}
CVE-2026-98697
- USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
CVE-2026-98769
- usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
CVE-2026-98764
- usb: gadget: f_fs: Fix NULL pointer dereference in …

Record: CLSA-2026-1792980237
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11476-1 No score

kernel-devel-7.1.7-1.1 on GA media

These are all security issues fixed in the kernel-devel-7.1.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11476-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:22091-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
CVE-2026-64475: vfio/pci: Release the…

Record: openSUSE-SU-2026:22091-1
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2026-64448 No score

CVE-2026-64448 in linux - Patched by Root

Root has patched CVE-2026-64448 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-64448
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-64448 No score

CVE-2026-64448 in linux - Patched by Root

Root has patched CVE-2026-64448 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-64448
Updated: 2026-11-06

OSVSUSE-SU-2026:23477-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23477-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23481-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23481-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23528-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23528-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23529-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23529-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24179-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
CVE-2026-64475: vfio/pci: Release the…

Record: SUSE-SU-2026:24179-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24184-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
CVE-2026-64475: vfio/pci: Release the…

Record: SUSE-SU-2026:24184-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24197-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
CVE-2026-64475: vfio/pci: Release the…

Record: SUSE-SU-2026:24197-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24235-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
CVE-2026-64475: vfio/pci: Release the…

Record: SUSE-SU-2026:24235-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4120-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43014: net: macb: properly unregister fixed rate clocks (bsc#1264012).
CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
CVE-2026-53059: dm…

Record: SUSE-SU-2026:4120-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4254-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
CVE-2026-53059: dm log: fix out-of-bounds write due…

Record: SUSE-SU-2026:4254-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4687-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts (bsc#1265138).
CVE-2026-45834: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (bsc#1266412).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-46312: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (bsc#1267990).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-53037: HID: usbhid: fix deadlock in hid_post_reset() (bsc#1269081).
CVE-2026-53237: gpio: mvebu: fix NULL pointer dereference in suspend/resume (bsc#1269131).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (bsc#1271834).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1273953).
CVE-2026-63897: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (bsc#1272642).
CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check (bsc#1272499).
CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers (bsc#1272517).
CVE-2026-63903: USB: serial: belkin_sa: validate interrupt status length (bsc#1272522).
CVE-2026-63904: usb: usbtmc: check URB actual_length for interrupt-IN notifications (bsc#1272523).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63942: parport: Fix race between port and client registration (bsc#1273023).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63957: USB: serial: safe_serial: fix memory corruption with small endpoint (bsc#1272472).
CVE-2026-63961: usb: typec: altmodes/displayport: validate count before reading Status Update VDO (bsc#1272480).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (bsc#1273769).
CVE-2026-64097: drm/amd/display: Validate GPIO pin LUT table size before iterating (bsc#1273480).
CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length (bsc#1272211).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64320: nvmet: fix discover log page when offsets are used (bsc#1273420).
CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect (bsc#1274011).
CVE-2026-64348: usb: free iso schedules on failed submit (bsc#1274026).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).
CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982). -…

Record: SUSE-SU-2026:4687-1
Updated: 2026-11-02

OSVUSN-8726-1 No score

linux, linux-aws, linux-aws-7.0, linux-gcp, linux-gke, linux-hwe-7.0, linux-realtime vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer (TLB) invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been revoked, bypassing memory protections or escalating privileges. (CVE-2025-10263)