CVE-2026-68096

audit: fix recursive locking deadlock in audit_dupe_exe()

7.5 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

audit: fix recursive locking deadlock in audit_dupe_exe()

A deadlock occurs in the audit subsystem when duplicating executable-related rules.

When a file is moved (e.g., via do_renameat2()), the VFS layer locks the parent directory (I_MUTEX_PARENT), which synchronously triggers an fsnotify_move event. If an existing executable audit rule matches the file being moved, the audit subsystem catches this event and calls audit_dupe_exe() to duplicate the watch and update the rule. Then, audit_alloc_mark() would call kern_path_parent() to resolve the path, leading to a blind attempt to acquire the exact same I_MUTEX_PARENT lock already held by the task, resulting in the following recursive locking deadlock:

============================================ WARNING: possible recursive locking detected 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted

mv/5099 is trying to acquire lock: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: __kern_path_locked+0x10a/0x2f0

but task is already holding lock: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: lock_two_directories+0x13f/0x2b0

other info that might help us debug this: Possible unsafe locking scenario:

    CPU0
    ----

lock(&inode->i_sb->s_type->i_mutex_dir_key/1); lock(&inode->i_sb->s_type->i_mutex_dir_key/1);

*** DEADLOCK ***

May be due to missing lock nesting notation

6 locks held by mv/5099: #0: ffff888112a9c440 (sb_writers#13) at: do_renameat2+0x34c/0xbc0 #1: ffff888112a9c790 (&type->s_vfs_rename_key#3) at: do_renameat2+0x415/0xbc0 #2: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1) at: lock_two_directories+0x13f/0x2b0 #3: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/5) at: lock_two_directories+0x175/0x2b0 #4: ffffffffb3a1fb10 (&fsnotify_mark_srcu) at: fsnotify+0x454/0x28a0 #5: ffffffffaf886230 (audit_filter_mutex) at: audit_update_watch+0x36/0x11e0

stack backtrace: Call Trace: <TASK> dump_stack_lvl+0x6f/0xb0 print_deadlock_bug.cold+0xbd/0xca validate_chain+0x83a/0xf00 __lock_acquire+0xcac/0x1d20 lock_acquire.part.0+0x11b/0x360 down_write_nested+0x9f/0x230 __kern_path_locked+0x10a/0x2f0 kern_path_locked+0x26/0x40 audit_alloc_mark+0xfb/0x4f0 audit_dupe_exe+0x6c/0xe0 audit_dupe_rule+0x6c2/0xc00 audit_update_watch+0x4cc/0x11e0 audit_watch_handle_event+0x12c/0x1b0 send_to_group+0x5d0/0x8b0 fsnotify+0x615/0x28a0 fsnotify_move+0x1d8/0x630 vfs_rename+0xdcd/0x1df0 do_renameat2+0x9d4/0xbc0 __x64_sys_renameat+0x192/0x260 do_syscall_64+0x92/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0491fe8c4e Code: 0f 1f 40 00 48 8b 15 c1 e1 16 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 08 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 89 RSP: 002b:00007ffc7210bf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000108 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0491fe8c4e RDX: 0000000000000003 RSI: 00007ffc7210e6c8 RDI: 00000000ffffff9c RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: 00005575eb2dae2a R11: 0000000000000246 R12: 00005575eb2dae2a R13: 00007ffc7210e6c8 R14: 0000000000000003 R15: 00000000ffffff9c </TASK>

The aforementioned deadlock can be consistently reproduced by running the script below:

audit-dupe-exe-deadlock.sh

#!/bin/bash auditctl -D mkdir -p /tmp/foo touch /tmp/file auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr mv /tmp/file /tmp/foo/file rm -Rf /tmp/foo

This patch fixes the issue by introducing struct audit_watch_ctx to pass the fsnotify event context down to audit_alloc_mark(). By utilizing the already-resolved directory inode provided by the event, we bypass the kern_path_parent() path resol ---truncated---

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.53%Up 0.4 points since Aug 11, 2026

What each source reports

CVE List Score used 7.5

audit: fix recursive locking deadlock in audit_dupe_exe()

In the Linux kernel, the following vulnerability has been resolved:

audit: fix recursive locking deadlock in audit_dupe_exe()

A deadlock occurs in the audit subsystem when duplicating executable-related rules.

============================================ WARNING: possible recursive locking detected 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted

mv/5099 is trying to acquire lock: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: __kern_path_locked+0x10a/0x2f0

but task is already holding lock: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: lock_two_directories+0x13f/0x2b0

other info that might help us debug this: Possible unsafe locking scenario:

    CPU0
    ----

lock(&inode->i_sb->s_type->i_mutex_dir_key/1); lock(&inode->i_sb->s_type->i_mutex_dir_key/1);

*** DEADLOCK ***

May be due to missing lock nesting notation

The aforementioned deadlock can be consistently reproduced by running the script below:

audit-dupe-exe-deadlock.sh

#!/bin/bash auditctl -D mkdir -p /tmp/foo touch /tmp/file auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr mv /tmp/file /tmp/foo/file rm -Rf /tmp/foo

Record: CVE-2026-68096
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-835
Updated: 2026-11-02

EUVDEUVD-2026-55477 7.5

In the Linux kernel, the following vulnerability has been resolved:

audit: fix recursive locking deadlock in audit_dupe_exe()

A deadlock occurs in the audit subsystem when duplicating executable-related rules.

============================================ WARNING: possible recursive locking detected 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted

mv/5099 is trying to acquire lock: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: __kern_path_locked+0x10a/0x2f0

but task is already holding lock: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: lock_two_directories+0x13f/0x2b0

other info that might help us debug this: Possible unsafe locking scenario:

    CPU0
    ----

lock(&inode->i_sb->s_type->i_mutex_dir_key/1); lock(&inode->i_sb->s_type->i_mutex_dir_key/1);

*** DEADLOCK ***

May be due to missing lock nesting notation

The aforementioned deadlock can be consistently reproduced by running the script below:

audit-dupe-exe-deadlock.sh

#!/bin/bash auditctl -D mkdir -p /tmp/foo touch /tmp/file auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr mv /tmp/file /tmp/foo/file rm -Rf /tmp/foo

Record: EUVD-2026-55477
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-mpg4-cv8q-2gfg 7.5

In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking...

In the Linux kernel, the following vulnerability has been resolved:

audit: fix recursive locking deadlock in audit_dupe_exe()

A deadlock occurs in the audit subsystem when duplicating executable-related rules.

============================================ WARNING: possible recursive locking detected 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted

mv/5099 is trying to acquire lock: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: __kern_path_locked+0x10a/0x2f0

but task is already holding lock: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: lock_two_directories+0x13f/0x2b0

other info that might help us debug this: Possible unsafe locking scenario:

    CPU0
    ----

lock(&inode->i_sb->s_type->i_mutex_dir_key/1); lock(&inode->i_sb->s_type->i_mutex_dir_key/1);

*** DEADLOCK ***

May be due to missing lock nesting notation

The aforementioned deadlock can be consistently reproduced by running the script below:

audit-dupe-exe-deadlock.sh

#!/bin/bash auditctl -D mkdir -p /tmp/foo touch /tmp/file auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr mv /tmp/file /tmp/foo/file rm -Rf /tmp/foo

Record: GHSA-mpg4-cv8q-2gfg
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-835
Updated: 2026-11-02

NVD 7.5

In the Linux kernel, the following vulnerability has been resolved:

audit: fix recursive locking deadlock in audit_dupe_exe()

A deadlock occurs in the audit subsystem when duplicating executable-related rules.

============================================ WARNING: possible recursive locking detected 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted

mv/5099 is trying to acquire lock: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: __kern_path_locked+0x10a/0x2f0

but task is already holding lock: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: lock_two_directories+0x13f/0x2b0

other info that might help us debug this: Possible unsafe locking scenario:

    CPU0
    ----

lock(&inode->i_sb->s_type->i_mutex_dir_key/1); lock(&inode->i_sb->s_type->i_mutex_dir_key/1);

*** DEADLOCK ***

May be due to missing lock nesting notation

The aforementioned deadlock can be consistently reproduced by running the script below:

audit-dupe-exe-deadlock.sh

#!/bin/bash auditctl -D mkdir -p /tmp/foo touch /tmp/file auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr mv /tmp/file /tmp/foo/file rm -Rf /tmp/foo

Record: CVE-2026-68096
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-835
Updated: 2026-11-02

OSVBELL-CVE-2026-68096 7.5

Record: BELL-CVE-2026-68096
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

audit: fix recursive locking deadlock in audit_dupe_exe()

In the Linux kernel, the following vulnerability has been resolved:

audit: fix recursive locking deadlock in audit_dupe_exe()

A deadlock occurs in the audit subsystem when duplicating executable-related rules.

============================================ WARNING: possible recursive locking detected 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted

mv/5099 is trying to acquire lock: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: __kern_path_locked+0x10a/0x2f0

but task is already holding lock: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: lock_two_directories+0x13f/0x2b0

other info that might help us debug this: Possible unsafe locking scenario:

    CPU0
    ----

lock(&inode->i_sb->s_type->i_mutex_dir_key/1); lock(&inode->i_sb->s_type->i_mutex_dir_key/1);

*** DEADLOCK ***

May be due to missing lock nesting notation

The aforementioned deadlock can be consistently reproduced by running the script below:

audit-dupe-exe-deadlock.sh

#!/bin/bash auditctl -D mkdir -p /tmp/foo touch /tmp/file auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr mv /tmp/file /tmp/foo/file rm -Rf /tmp/foo

Record: CVE-2026-68096
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 31 moreShow less

OSVDEBIAN-CVE-2026-68096 7.5

In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking deadlock in audit_dupe_exe() A deadlock occurs in the audit subsystem when duplicating executable-related rules. When a file is moved (e.g., via do_renameat2()), the VFS layer locks the parent directory (I_MUTEX_PARENT), which synchronously triggers an fsnotify_move event. If an existing executable audit rule matches the file being moved, the audit subsystem catches this event and calls audit_dupe_exe() to duplicate the watch and update the rule. Then, audit_alloc_mark() would call kern_path_parent() to resolve the path, leading to a blind attempt to acquire the exact same I_MUTEX_PARENT lock already held by the task, resulting in the following recursive locking deadlock: ============================================ WARNING: possible recursive locking detected 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted -------------------------------------------- mv/5099 is trying to acquire lock: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: __kern_path_locked+0x10a/0x2f0 but task is already holding lock: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: lock_two_directories+0x13f/0x2b0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&inode->i_sb->s_type->i_mutex_dir_key/1); lock(&inode->i_sb->s_type->i_mutex_dir_key/1); *** DEADLOCK *** May be due to missing lock nesting notation 6 locks held by mv/5099: #0: ffff888112a9c440 (sb_writers#13) at: do_renameat2+0x34c/0xbc0 #1: ffff888112a9c790 (&type->s_vfs_rename_key#3) at: do_renameat2+0x415/0xbc0 #2: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1) at: lock_two_directories+0x13f/0x2b0 #3: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/5) at: lock_two_directories+0x175/0x2b0 #4: ffffffffb3a1fb10 (&fsnotify_mark_srcu) at: fsnotify+0x454/0x28a0 #5: ffffffffaf886230 (audit_filter_mutex) at: audit_update_watch+0x36/0x11e0 stack backtrace: Call Trace: <TASK> dump_stack_lvl+0x6f/0xb0 print_deadlock_bug.cold+0xbd/0xca validate_chain+0x83a/0xf00 __lock_acquire+0xcac/0x1d20 lock_acquire.part.0+0x11b/0x360 down_write_nested+0x9f/0x230 __kern_path_locked+0x10a/0x2f0 kern_path_locked+0x26/0x40 audit_alloc_mark+0xfb/0x4f0 audit_dupe_exe+0x6c/0xe0 audit_dupe_rule+0x6c2/0xc00 audit_update_watch+0x4cc/0x11e0 audit_watch_handle_event+0x12c/0x1b0 send_to_group+0x5d0/0x8b0 fsnotify+0x615/0x28a0 fsnotify_move+0x1d8/0x630 vfs_rename+0xdcd/0x1df0 do_renameat2+0x9d4/0xbc0 __x64_sys_renameat+0x192/0x260 do_syscall_64+0x92/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0491fe8c4e Code: 0f 1f 40 00 48 8b 15 c1 e1 16 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 08 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 89 RSP: 002b:00007ffc7210bf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000108 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0491fe8c4e RDX: 0000000000000003 RSI: 00007ffc7210e6c8 RDI: 00000000ffffff9c RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: 00005575eb2dae2a R11: 0000000000000246 R12: 00005575eb2dae2a R13: 00007ffc7210e6c8 R14: 0000000000000003 R15: 00000000ffffff9c </TASK> The aforementioned deadlock can be consistently reproduced by running the script below: audit-dupe-exe-deadlock.sh -------------------------- #!/bin/bash auditctl -D mkdir -p /tmp/foo touch /tmp/file auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr mv /tmp/file /tmp/foo/file rm -Rf /tmp/foo This patch fixes the issue by introducing struct audit_watch_ctx to pass the fsnotify event context down to audit_alloc_mark(). By utilizing the already-resolved directory inode provided by the event, we bypass the kern_path_parent() path resol ---truncated---

Record: DEBIAN-CVE-2026-68096
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-68096 6.7

Record: UBUNTU-CVE-2026-68096
CVSS 4.0: 6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-10

OSVCLSA-2026-1788170774 No score

kernel: Fix of 132 CVEs

sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
fanotify: fix false positive on permission events {CVE-2026-46150}
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
Bluetooth: serialize accept_q access {CVE-2026-52918}
ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
libceph: bound…

Record: CLSA-2026-1788170774
Updated: 2026-11-02

OSVCLSA-2026-1788257079 No score

kernel: Fix of 131 CVEs

sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
fanotify: fix false positive on permission events {CVE-2026-46150}
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
Bluetooth: serialize accept_q access {CVE-2026-52918}
ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
libceph: bound…

Record: CLSA-2026-1788257079
Updated: 2026-11-02

OSVCLSA-2026-1788259625 No score

kernel: Fix of 132 CVEs

sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
fanotify: fix false positive on permission events {CVE-2026-46150}
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
Bluetooth: serialize accept_q access {CVE-2026-52918}
ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
libceph: bound…

Record: CLSA-2026-1788259625
Updated: 2026-11-02

OSVCLSA-2026-1792239979 No score

kernel: Fix of 73 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}
ip6: vti: Use ip6_tnl.net in vti6_changelink(). {CVE-2026-63917}
bpf: Mask pseudo pointer values in verifier logs {CVE-2026-72402}
drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286}
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362}
gve: fix Rx queue stall on alloc failure {CVE-2026-68129}
vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294}
nbd: restrict sockets to TCP and UDP {CVE-2025-40080}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
scsi: smartpqi: Fix device resources accessed after device removal {CVE-2025-68371}
cifs: fix oops during encryption {CVE-2022-50341}
net: qrtr: ns: Limit the maximum server registration per node {CVE-2026-43491}
mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
xfs: clean up dqblk extraction {CVE-2026-80529}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
bpf: Fix accesses to uninit stack slots {CVE-2023-52452}
bpf: Allow reads from uninit stack {CVE-2023-52452}
fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release() {CVE-2023-52731}
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() {CVE-2026-68324}
nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
net/sched: ets: use old 'nbands' while purging unused classes {CVE-2025-38684}
net_sched: ets: fix a race in ets_qdisc_change() {CVE-2025-38107}
fbcon: Fix OOB access in font allocation {CVE-2025-39967}
fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
kyber: fix out of bounds access when preempted {CVE-2021-46984}
padata: Reset next CPU when reorder sequence wraps around {CVE-2025-38584}
padata: Fix pd UAF once and for all {CVE-2025-38584}
padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-53333}
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
ALSA: firewire-motu: add bounds check in put_user loop for DSP events {CVE-2025-68753}
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events {CVE-2025-68347}
HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
cifs: Fix lost destroy smbd connection when MR allocate failed {CVE-2023-54260}
cifs: Fix oops due to uncleared server->smbd_conn in reconnect {CVE-2023-53006}
PCI/ASPM:…

Record: CLSA-2026-1792239979
Updated: 2026-11-02

OSVMGASA-2026-0336 No score

Updated kernel, kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages fix security vulnerabilities

Upstream kernel 6.18.44 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Record: MGASA-2026-0336
Updated: 2026-11-02

OSVMGASA-2026-0337 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.18.44 fixes vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0337
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21910-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: openSUSE-SU-2026:21910-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23881-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23881-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23887-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23887-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23897-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23897-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23902-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23902-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24181-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). -…

Record: SUSE-SU-2026:24181-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24182-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c:…

Record: SUSE-SU-2026:24182-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24315-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). -…

Record: SUSE-SU-2026:24315-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24316-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c:…

Record: SUSE-SU-2026:24316-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4640-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64373: cpufreq: Fix hotplug-suspend race during…

Record: SUSE-SU-2026:4640-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4706-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64373: cpufreq: Fix hotplug-suspend race during…

Record: SUSE-SU-2026:4706-1
Updated: 2026-11-02

OSVUSN-8886-1 No score

linux-nvidia-tegra vulnerabilities