CVE-2026-68202

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains borrowers, and snd_seq_timer_delete() frees q->timer. A borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT that took a queueptr() use_lock reference before the queue was unlinked runs snd_seq_timer_open() after the close. Open refuses re-open only while timeri is set, and the close just cleared it, so it re-opens timeri. snd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop() is a no-op, because running was cleared first. So it frees q->timer with the instance still live. The queue is freed next. The instance stays on the global timer with callback_data pointing at the freed queue. A non-owner START on the unlocked queue arms it. The next tick derefs the freed queue in snd_seq_timer_interrupt(). Reachable by an unprivileged user with access to /dev/snd/seq. No CAP and no queue ownership required. Close any lingering instance in the destructor. There, ->timeri can no longer change: the queue is unlinked and all use_lock borrowers have drained, so no snd_seq_queue_use() can re-open it. Close it before clearing q->timer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt() to finish, and that callback still reads q->timer (via snd_seq_check_queue()), so q->timer must stay valid until it drains.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)

• kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

• kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)

• kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

• kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

• kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)

• kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)

• kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

• kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)

• kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

• kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

• kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)

• kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)

• kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

• kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)

• kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

• kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)

• kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

• kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530)

• kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

Bug Fix(es) and Enhancement(s):

• RTLA segfaults on freed memory access on double SIGINT [rhel-9.8.z] (JIRA:Rocky Linux-193029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)

• kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)

• kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)

• kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)

• kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)

• kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)

• kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)

• kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)

• kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)

• kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)

• kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)

• kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

• kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)

• kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)

• kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)

• kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)

• kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

• kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)

Bug Fix(es) and Enhancement(s):

• Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [rhel-10.2.z] (JIRA:Rocky Linux-179066)

• RTLA segfaults on freed memory access on double SIGINT [rhel-10.2.z] (JIRA:Rocky Linux-193031)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: close a re-opened queue timer in the destructor queue_delete() closes the queue timer, then frees it. snd_seq_timer_close() clears q->timer->timeri. snd_use_lock_sync() then drains borrowers, and snd_seq_timer_delete() frees q->timer. A borrower can re-open the timer inside that window. A SET_QUEUE_CLIENT that took a queueptr() use_lock reference before the queue was unlinked runs snd_seq_timer_open() after the close. Open refuses re-open only while timeri is set, and the close just cleared it, so it re-opens timeri. snd_seq_timer_delete() does not close that instance. Its snd_seq_timer_stop() is a no-op, because running was cleared first. So it frees q->timer with the instance still live. The queue is freed next. The instance stays on the global timer with callback_data pointing at the freed queue. A non-owner START on the unlocked queue arms it. The next tick derefs the freed queue in snd_seq_timer_interrupt(). Reachable by an unprivileged user with access to /dev/snd/seq. No CAP and no queue ownership required. Close any lingering instance in the destructor. There, ->timeri can no longer change: the queue is unlinked and all use_lock borrowers have drained, so no snd_seq_queue_use() can re-open it. Close it before clearing q->timer. snd_timer_close() waits for any in-flight snd_seq_timer_interrupt() to finish, and that callback still reads q->timer (via snd_seq_check_queue()), so q->timer must stay valid until it drains.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
• kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
• kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
• kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
• kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
• kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)
• kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
• kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
• kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
• kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
• kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
• kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)
• kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063)
• kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
• kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
• kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
• kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)
• kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
• kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530)
• kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)

Bug Fix(es) and Enhancement(s):

• RTLA segfaults on freed memory access on double SIGINT [almalinux-9.8.z] (JIRA:AlmaLinux-193029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147)
• kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114)
• kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)
• kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481)
• kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266)
• kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572)
• kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
• kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202)
• kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
• kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
• kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448)
• kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536)
• kernel: inet: frags: strip GSO state from fragments before reassembly (CVE-2026-80590)
• kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
• kernel: perf: Fix use-after-free when perf mmap() revival races with the last munmap() (CVE-2026-89791)
• kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
• kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
• kernel: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CVE-2026-97493)

Bug Fix(es) and Enhancement(s):

• Backport request: bonding: only set speed/duplex to unknown, if getting speed failed [almalinux-10.2.z] (JIRA:AlmaLinux-179066)
• RTLA segfaults on freed memory access on double SIGINT [almalinux-10.2.z] (JIRA:AlmaLinux-193031)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
• sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
• xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
• xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
• Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
• btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
• netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
• audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• Bluetooth: serialize accept_q access {CVE-2026-52918}
• ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
• libceph: bound…

• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
• ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}
• scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}
• nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
• ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
• sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
• RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884}
• wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• Bluetooth: hci_sync: Protect UUID list traversal {CVE-2026-68189}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
• Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
• net_sched: red: fix a race in __red_change() {CVE-2025-38108}
• iio: event: Fix event FIFO reset race {CVE-2026-64496}
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}
• media: cx23885: add ioremap return check and cleanup {CVE-2026-68226}
• tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev {CVE-2026-68176} -…

• drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251}
• amd/amdkfd: sync all devices to wait all processes being evicted {CVE-2024-36949}
• Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted {CVE-2024-36909}
• Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl {CVE-2024-36912}
• xfs: save ailp before dropping the AIL lock in push callbacks {CVE-2026-31454}
• net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak {CVE-2026-43041}
• netfilter: nf_conntrack: destroy stale expectfn expectations on unregister {CVE-2026-53349}
• cifs: avoid NULL pointer dereference in dbg call {CVE-2025-37844}
• fs/notify: call exportfs_encode_fid with s_umount {CVE-2025-40237}
• cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258}
• pstore/ram: fix buffer overflow in persistent_ram_save_old() {CVE-2026-46253}
• Bluetooth: ISO: fix iso_conn related locking and validity issues {CVE-2023-54164}
• netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873}
• ext4: always drain queued discard work in ext4_mb_release() {CVE-2026-43065}
• ipvs: Defer ip_vs_ftp unregister during netns cleanup {CVE-2025-40018}
• Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
• sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto {CVE-2025-40281}
• fscache: Use wait_on_bit() to wait for the freeing of relinquished volume {CVE-2023-52982}
• libceph: prevent potential out-of-bounds reads in process_message_header() {CVE-2026-43406}
• netfilter: nf_tables: reject immediate NF_QUEUE verdict {CVE-2026-43024}
• ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() {CVE-2025-68261}
• bpf, sockmap: Fix af_unix iter deadlock {CVE-2026-53035}
• sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
• netfilter: xt_CT: drop pending enqueued packets on template removal {CVE-2026-23391}
• netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457}
• libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407}
• af_unix: read UNIX_DIAG_VFS data under unix_state_lock {CVE-2026-31673}
• jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted {CVE-2025-68337}
• Bluetooth: Fix NULL pointer deference on eir_get_service_data {CVE-2025-38304}
• net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption {CVE-2026-31533}
• fsnotify: do not generate ACCESS/MODIFY events on child for special files {CVE-2025-68788}
• isofs: validate Rock Ridge CE continuation extent against volume size {CVE-2026-46303}
• net: strparser: fix skb_head leak in strp_abort_strp() {CVE-2026-46102}
• sctp: fix uninit-value in __sctp_rcv_asconf_lookup() {CVE-2026-53225}
• xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
• xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
• bpf: tcp: fix double sock release on batch realloc {CVE-2026-64575}
• bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714}
• bpf: tcp: Avoid socket skips and repeats during iteration {CVE-2026-74714}
• bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items {CVE-2026-74714}
• bpf: tcp: Get rid of st_bucket_done {CVE-2026-74714}
• bpf: tcp: Make sure iter->batch always contains a full bucket snapshot {CVE-2026-64575}
• bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch {CVE-2026-74714}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689}
• net: add copy_safe_from_sockptr() helper {CVE-2026-74689}
• xfs: close crash window in attr dabtree…

• dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
• mm/damon/core: validate ranges in damon_set_regions() {CVE-2026-68165}
• netpoll: Fix deadlock in memory allocation under spinlock {CVE-2025-68169}
• drm/amdkfd: Check bounds on CRIU restore queue type and mqd size {CVE-2026-68258}
• gve: fix Rx queue stall on alloc failure {CVE-2026-68129}
• drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234}
• libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE {CVE-2026-68159}
• media: v4l2-ctrls: validate HEVC active reference counts {CVE-2026-68206}
• drm/i915/hdcp: check streams[] bounds before overflow {CVE-2026-68253}
• drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() {CVE-2026-68245}
• drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() {CVE-2026-68115}
• drm/i915: Return NULL on error in active_instance {CVE-2026-68248}
• smb: client: validate DFS referral PathConsumed {CVE-2026-68343}
• ext4: fix use-after-free in update_super_work when racing with umount {CVE-2026-31446}
• debugobjects: Plug race against a concurrent OOM disable {CVE-2026-68090}
• HID: wacom: stop hardware after post-start probe failures {CVE-2026-68091}
• drm/xe/pt: Reset current_op in xe_pt_update_ops_init() {CVE-2026-68264}
• net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD {CVE-2026-68288}
• drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() {CVE-2026-68113}
• openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}
• drm/amd/display: use kvzalloc to allocate struct dc {CVE-2026-68436}
• drm/i915/gem: Add missing nospec on parallel submit slot {CVE-2026-68269}
• Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update {CVE-2026-68394}
• sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162}
• wifi: mt76: mt7925: fix crash in reset link replay {CVE-2026-68307}
• Bluetooth: hci_sync: extend conn_hash lookup critical sections {CVE-2026-68393}
• drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU {CVE-2026-68243}
• block: fix memory leak in __blkdev_issue_zero_pages {CVE-2026-68348}
• drm/amdgpu/gfx: fix cleaner shader IB buffer overflow {CVE-2026-68276}
• tracing: Do not call map->ops->elt_free() if elt_alloc() fails {CVE-2026-64173}
• wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362}
• ovl: check access to copy_file_range source with src mounter creds {CVE-2026-68448}
• drm/nouveau: fix reversed error cleanup order in ucopy functions {CVE-2026-68271}
• vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
• drm/vmwgfx: Validate vmw_surface_metadata::array_size {CVE-2026-68446}
• net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM {CVE-2026-68296}
• Input: elan_i2c - prevent division by zero and arithmetic underflow {CVE-2026-64275}
• iomap: fix out-of-bounds bitmap_set() with zero-length range {CVE-2026-68145}
• vsock: fix lock inversion in vsock_assign_transport() {CVE-2025-40231}
• ASoC: nau8821: Cancel delayed work on component remove {CVE-2026-45963}
• ext4: validate p_idx bounds in ext4_ext_correct_indexes {CVE-2026-31449}
• ipc: fix memleak if msg_init_ns failed in create_ipc_ns {CVE-2024-53175}
• tls: make sure to abort the stream if headers are bogus {CVE-2025-39946}
• ipv6: prevent infinite loop in rt6_nlmsg_size() {CVE-2025-38588}
• gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL {CVE-2026-23386}
• xsk: validate MTU against usable frame size on bind {CVE-2026-43092}
• RDMA/irdma: Harden depth calculation functions {CVE-2026-31491}
• iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() {CVE-2026-31505}
• net/ip6_tunnel: Prevent perpetual tunnel growth {CVE-2025-40173}
• net/mlx5: Fix deadlock between devlink lock and esw->wq {CVE-2026-43468}
• mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458}
• fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling {CVE-2026-52946}
• nvmet: move async event…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2025-39827
  • net: rose: include node references in rose_neigh refcount {CVE-2025-39827}
• CVE-2026-93140
  • udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
• CVE-2026-90112
  • net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
• CVE-2026-90237
  • netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237}
• CVE-2026-93051
  • misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051}
• CVE-2026-90379
  • wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90383
  • misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-93047
  • drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047}
• CVE-2026-93192
  • drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192}
• CVE-2026-93050
  • ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050}
• CVE-2026-90311
  • thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311}
• CVE-2026-93191
  • smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191}
• CVE-2026-93042
  • dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042}
• CVE-2026-93056
  • usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
• CVE-2026-93203
  • batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203}
• CVE-2026-93204
  • batman-adv: dat: atomically update mac addresses {CVE-2026-93204}
• CVE-2026-90000
  • HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-93202
  • i3c: master: Fix recursive locking during device registration {CVE-2026-93202}
• CVE-2026-90347
  • arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347}
• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-92500
  • ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}
• CVE-2026-93196
  • nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
• CVE-2026-90207
  • ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-90110
  • inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110}
• CVE-2026-90293
  • IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
• CVE-2026-89838
  • f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
• CVE-2026-93177
  • drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177}
• CVE-2026-89823
  • drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
• CVE-2026-90041
  • HID: sony: clean up device list on probe failure {CVE-2026-90041}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-93095 -…

• CVE-2024-36894
  • usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
• CVE-2026-97447
  • ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
• CVE-2026-93822
  • PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
• CVE-2026-93826
  • HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• CVE-2026-97954
  • net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
• CVE-2026-97949
  • configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• CVE-2026-97931
  • ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• CVE-2026-97940
  • ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• CVE-2026-97539
  • usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• CVE-2026-74510
  • Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• CVE-2026-72084
  • scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-90321
  • ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-74637
  • perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• CVE-2026-74752
  • sctp: validate cookie AUTH state before use {CVE-2026-74752}
• CVE-2026-74387
  • ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• CVE-2026-80536
  • xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• CVE-2026-89659
  • NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• CVE-2026-80576
  • drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• CVE-2026-90223
  • nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
• CVE-2026-80994
  • net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• CVE-2026-72398
  • sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• CVE-2026-74583
  • net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• CVE-2026-72322
  • ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• CVE-2026-93095
  • hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
• CVE-2026-72472
  • nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-90421
  • PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• CVE-2026-64583
  • usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
• CVE-2026-68329
  • iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
• CVE-2026-89448
  • iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• CVE-2026-64001
  • ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
• CVE-2026-64305
  • crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• CVE-2026-64348
  • usb: free iso schedules on failed submit {CVE-2026-64348}
• CVE-2026-64422
  • net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• CVE-2026-90180
  • block:…

• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
• wifi: libipw: reject too-short association responses {CVE-2026-98348}
• net: lock the socket in sock_gettstamp() {CVE-2026-98276}
• ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
• wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
• wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• ALSA: usb-audio: fix OOB write in…

• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
• wifi: libipw: reject too-short association responses {CVE-2026-98348}
• net: lock the socket in sock_gettstamp() {CVE-2026-98276}
• ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
• wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
• wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• ALSA: usb-audio: fix OOB write in…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}
• tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
• Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
• drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}
• RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
• mm/khugepaged: fix ->anon_vma race {CVE-2023-52935}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
• md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}
• bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
• net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
• nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
• tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
• crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
• nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}
• isdn: cpai: check ctr->cnr…

• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}
• net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
• drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
• drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
• ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}
• vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}
• tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
• bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
• bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961}
• dm cache: fix null-deref with concurrent writes in passthrough mode {CVE-2026-53064}
• net: bonding: fix use-after-free after 802.3ad slave unbind {CVE-2022-49667}
• bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
• md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}
• tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
• crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
• nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}
• ALSA: 6fire: fix use-after-free on disconnect…

Upstream kernel 6.18.44 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.18.44 fixes vulnerabilities. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.36.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.35.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.34.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.33.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.32.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.31.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.30.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.29.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.28.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.27.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.26.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.9.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).

This update for the SUSE Linux Enterprise Kernel 6.12.0-160000.8.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-46116: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (bsc#1267370).
• CVE-2026-63802: blk-cgroup: fix UAF in __blkcg_rstat_flush() (bsc#1272283).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272391).
• CVE-2026-63912: xfrm: esp: restore combined single-frag length gate (bsc#1272837).
• CVE-2026-63917: ip6: vti: Use ip6_tnl.net in vti6_changelink() (bsc#1273015).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1273012).
• CVE-2026-63921: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (bsc#1273011).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1273003).
• CVE-2026-63971: sctp: fix race between sctp_wait_for_connect and peeloff (bsc#1272679).
• CVE-2026-63994: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (bsc#1273051).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273052).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1276493).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273833).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues (bsc#1273837).
• CVE-2026-64189: netfilter: ipset: fix race between dump and ip_set_list resize (bsc#1272208).
• CVE-2026-68121: pppoe: reload header pointer after dev_hard_header() (bsc#1275228).
• CVE-2026-68202: ALSA: seq: close a re-opened queue timer in the destructor (bsc#1275162).
• CVE-2026-72217: SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing (bsc#1276299).
• CVE-2026-74394: RDMA/srpt: fix integer overflow in immediate data length check (bsc#1277409).
• CVE-2026-74612: veth: fix skb length accounting after XDP frag adjustment (bsc#1277506).