CVE-2026-68320

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

7.3 HighFix available

What does this mean?

: 7.3v3.1, from CVE List
: 0.13%2nd percentile
Fixed in: 6.1.189-r0linux-lts
Published: August 10, 2026
Modified: November 10, 2026
Weakness: CWE-787
Also known as: BELL-CVE-2026-68320CLSA-2026-1787305050CLSA-2026-1787935638CLSA-2026-1788170774CLSA-2026-1788257079CLSA-2026-1788259625CLSA-2026-1789141176CLSA-2026-1791132071
Show 43 moreShow less
CLSA-2026-1791132078CLSA-2026-1791132991CLSA-2026-1791852988CLSA-2026-1791858083CLSA-2026-1791946572CLSA-2026-1791949745CLSA-2026-1792020435DEBIAN-CVE-2026-68320EUVD-2026-55421GHSA-f7gm-j66v-p95wMGASA-2026-0336MGASA-2026-0337OESA-2026-4039SUSE-SU-2026:23477-1SUSE-SU-2026:23481-1SUSE-SU-2026:23528-1SUSE-SU-2026:23529-1SUSE-SU-2026:23881-1SUSE-SU-2026:23887-1SUSE-SU-2026:23897-1SUSE-SU-2026:23902-1SUSE-SU-2026:4120-1SUSE-SU-2026:4254-1SUSE-SU-2026:4282-1UBUNTU-CVE-2026-68320USN-8875-1USN-8875-2USN-8876-1USN-8877-1USN-8878-1USN-8879-1USN-8886-1USN-8887-1USN-8887-2USN-8887-3USN-8888-1USN-8888-2USN-8889-1USN-8917-1USN-8918-1USN-8963-1USN-9003-1openSUSE-SU-2026:21910-1

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, allowing it to hold up to 20 chunk entries (param_hdr.length up to 24). However, the copy destination asoc->c.auth_chunks in struct sctp_cookie is only SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16 chunks are added, sctp_association_init() memcpy overflows the destination by up to 4 bytes.

Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: High

Exploit likelihood

0.13%Unchanged since Aug 11, 2026

What each source reports

CVE List Score used 7.3

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.

Record: CVE-2026-68320
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2026-55421 7.3

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.

Record: EUVD-2026-55421
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-f7gm-j66v-p95w 7.3

In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_chunk_list...

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.

Record: GHSA-f7gm-j66v-p95w
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

NVD 7.3

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.

Record: CVE-2026-68320
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVBELL-CVE-2026-68320 7.3

Record: BELL-CVE-2026-68320
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Updated: 2026-11-02

OSV 7.3

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.

Record: CVE-2026-68320
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Updated: 2026-11-02

Show 48 moreShow less

OSVDEBIAN-CVE-2026-68320 7.3

In the Linux kernel, the following vulnerability has been resolved: sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the capacity limit for ep->auth_chunk_list, allowing it to hold up to 20 chunk entries (param_hdr.length up to 24). However, the copy destination asoc->c.auth_chunks in struct sctp_cookie is only SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16 chunks are added, sctp_association_init() memcpy overflows the destination by up to 4 bytes. Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching the destination capacity.

Record: DEBIAN-CVE-2026-68320
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-4039 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:ALSA: caiaq: Use snd_card_free_when_closed() at disconnectionThe USB disconnect callback is supposed to be short and not too-longwaiting. OTOH, the current code uses snd_card_free() atdisconnection, but this waits for the close of all used fds, hence itcan take long. It eventually blocks the upper layer USB ioctls, whichmay trigger a soft lockup.An easy workaround is to replace snd_card_free() withsnd_card_free_when_closed(). This variant returns immediately whilethe release of resources is done asynchronously by the card devicerelease at the last close.This patch also splits the code to the disconnect and the free phases;the former is called immediately at the USB disconnect callback whilethe latter is called from the card destructor.(CVE-2024-56531)

In the Linux kernel, the following vulnerability has been resolved:xsk: fix OOB map writes when deleting elementsJordy says: In the xsk_map_delete_elem function an unsigned integer(map->max_entries) is compared with a user-controlled signed integer(k). Due to implicit type conversion, a large unsigned value formap->max_entries can bypass the intended bounds check: if (k >= map->max_entries) return -EINVAL;This allows k to hold a negative value (between -2147483648 and -2),which is then used as an array index in m->xsk_map[k], which resultsin an out-of-bounds access. spin_lock_bh(&m->lock); map_entry = &m->xsk_map[k]; // Out-of-bounds map_entry old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write if (old_xs) xsk_map_sock_delete(old_xs, map_entry); spin_unlock_bh(&m->lock);The xchg operation can then be used to cause an out-of-bounds write.Moreover, the invalid map_entry passed to xsk_map_sock_delete can leadto further memory corruption. It indeed results in following splat:[76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108[76612.904330] #PF: supervisor write access in kernel mode[76612.909639] #PF: error_code(0x0002) - not-present page[76612.914855] PGD 0 P4D 0[76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP[76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470[76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019[76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60[76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff <48> 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31[76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246[76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000[76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000[76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007[76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8[76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0[76613.005303] FS: 00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000[76613.013517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0[76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000[76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400[76613.041086] PKRU: 55555554[76613.043842] Call Trace:[76613.046331] <TASK>[76613.048468] ? __die+0x20/0x60[76613.051581] ? page_fault_oops+0x15a/0x450[76613.055747] ? search_extable+0x22/0x30[76613.059649] ? search_bpf_extables+0x5f/0x80[76613.063988] ? exc_page_fault+0xa9/0x140[76613.067975] ? asm_exc_page_fault+0x22/0x30[76613.072229] ? xsk_map_delete_elem+0x2d/0x60[76613.076573] ? xsk_map_delete_elem+0x23/0x60[76613.080914] …

Record: OESA-2026-4039
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-68320 7.3

Record: UBUNTU-CVE-2026-68320
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Updated: 2026-11-10

OSVCLSA-2026-1787305050 No score

kernel: Fix of 87 CVEs

sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138}
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() {CVE-2025-40187}
sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() {CVE-2026-53221}
cifs: some missing initializations on replay {CVE-2026-31693}
drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286}
net/tcp-md5: Fix MAC comparison to be constant-time {CVE-2026-43383}
ima: Handle error code returned by ima_filter_rule_match() {CVE-2025-68740}
accel/ivpu: Add bounds check for firmware runtime memory {CVE-2026-53206}
ata: libata-core: Disable LPM on ST1000DM010-2EP102 {CVE-2026-43487}
ip6_vti: prevent moving the fallback device across netns {CVE-2026-52909}
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags {CVE-2025-68764}
bonding: fix devconf_all NULL dereference when IPv6 is disabled {CVE-2026-68336}
mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}
octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978}
net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}
spi: fix use-after-free on controller registration failure {CVE-2026-31389}
nvme: fix admin request_queue lifetime {CVE-2025-68265}
RDMA/bnxt_re: Add sanity checks on rdev validity {CVE-2025-21901}
smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350}
net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow {CVE-2025-39834}
sctp: Fix MAC comparison to be constant-time {CVE-2025-40204}
net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path {CVE-2025-39830}
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() {CVE-2026-23297}
thermal/of: Fix reference leak in thermal_of_cm_lookup() {CVE-2026-45925}
usbnet: Prevents free active kevent {CVE-2025-68312}
smb: client: fix oops due to uninitialised var in smb2_unlink() {CVE-2026-23282}
fs/buffer: add alert in try_to_free_buffers() for folios without buffers {CVE-2025-71295}
cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update {CVE-2025-23137}
Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync {CVE-2026-53251}
wifi: iwlwifi: mvm: don't send a 6E related command when not supported {CVE-2026-43325}
io_uring/napi: cap busy_poll_to 10 msec {CVE-2026-53321}
io_uring/net: fix io_req_post_cqe abuse by send bundle {CVE-2025-23154}
xfs: fix a resource leak in xfs_alloc_buftarg() {CVE-2026-46005}
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() {CVE-2026-68444}
i2c: core: fix adapter deregistration race {CVE-2026-64279}
wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() {CVE-2026-68439}
firmware: arm_ffa: Check for NULL FF-A ID table while driver registration {CVE-2026-64166}
wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() {CVE-2026-68309}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698}
ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408}
accel/ivpu: Add bounds checks for firmware log indices {CVE-2026-53205}
PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails {CVE-2026-45880}
nvme-multipath: fix lockdep WARN due to partition scan work {CVE-2025-68218}
dm: fix unlocked test for dm_suspended_md {CVE-2026-46327}
net: slip: serialize receive against buffer reallocation…

Record: CLSA-2026-1787305050
Updated: 2026-11-02

OSVCLSA-2026-1787935638 No score

kernel: Fix of 164 CVEs

wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds {CVE-2023-53582}
net/sched: accept TCA_STAB only for root qdisc {CVE-2024-50039}
bpf, sockmap: Several fixes to bpf_msg_pop_data {CVE-2024-56720}
net: add more sanity checks to qdisc_pkt_len_init() {CVE-2024-49948}
nvme-tcp: sanitize request list handling {CVE-2025-38264}
smb: client: fix double free of TCP_Server_Info::hostname {CVE-2025-21673}
net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
nfsd: never defer requests during idmap lookup {CVE-2026-45983}
openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
thermal: core: Fix thermal zone governor cleanup issues {CVE-2026-46021}
tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072}
netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
smb: client: fix krb5 mount with username option {CVE-2026-31392}
netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212}
USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016}
netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
fuse: reject fuse_notify() pagecache ops on directories {CVE-2026-53168}
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options {CVE-2026-53249}
ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
uio_hv_generic: Let userspace take care of interrupt mask {CVE-2025-40048}
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947}
net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
netfilter: nft_ct: fix missing expect put in obj eval {CVE-2026-52970}
netfilter: nf_tables: always walk all pending catchall elements {CVE-2026-23278}
crypto: af_alg - Cap AEAD AD length to 0x80000000 {CVE-2026-52972}
wifi: cfg80211: advance loop vars in cfg80211_merge_profile() {CVE-2026-64174}
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr {CVE-2026-53391}
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock {CVE-2026-63945}
pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
RDMA/vmw_pvrdma: Fix…

Record: CLSA-2026-1787935638
Updated: 2026-11-02

OSVCLSA-2026-1788170774 No score

kernel: Fix of 132 CVEs

sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
fanotify: fix false positive on permission events {CVE-2026-46150}
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
Bluetooth: serialize accept_q access {CVE-2026-52918}
ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
libceph: bound…

Record: CLSA-2026-1788170774
Updated: 2026-11-02

OSVCLSA-2026-1788257079 No score

kernel: Fix of 131 CVEs

sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
fanotify: fix false positive on permission events {CVE-2026-46150}
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
Bluetooth: serialize accept_q access {CVE-2026-52918}
ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
libceph: bound…

Record: CLSA-2026-1788257079
Updated: 2026-11-02

OSVCLSA-2026-1788259625 No score

kernel: Fix of 132 CVEs

sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
fanotify: fix false positive on permission events {CVE-2026-46150}
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
Bluetooth: serialize accept_q access {CVE-2026-52918}
ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
libceph: bound…

Record: CLSA-2026-1788259625
Updated: 2026-11-02

OSVCLSA-2026-1789141176 No score

kernel: Fix of 131 CVEs

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884}
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
Bluetooth: hci_sync: Protect UUID list traversal {CVE-2026-68189}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
net_sched: red: fix a race in __red_change() {CVE-2025-38108}
iio: event: Fix event FIFO reset race {CVE-2026-64496}
netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}
media: cx23885: add ioremap return check and cleanup {CVE-2026-68226}
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev {CVE-2026-68176} -…

Record: CLSA-2026-1789141176
Updated: 2026-11-02

OSVCLSA-2026-1791132071 No score

Fix of 159 CVEs

CVE-2026-64375
- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
- exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2026-90413
- IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
CVE-2026-53062
- dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
CVE-2026-64237
- Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
- Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
CVE-2026-64109
- af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
CVE-2025-38512
- wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
CVE-2025-38117
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
CVE-2026-22980
- nfsd: provide locking for v4_end_grace {CVE-2026-22980}
CVE-2023-53254
- cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
CVE-2025-37885
- KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
CVE-2026-23191
- ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
CVE-2025-37879
- 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
CVE-2023-53039
- HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
CVE-2019-12456
- scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
CVE-2024-46812
- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
CVE-2026-31761
- iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
CVE-2026-53120
- PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
CVE-2026-31598
- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
CVE-2026-43075
- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
CVE-2024-41013
- xfs: don't walk off the end of a directory data block {CVE-2024-41013}
CVE-2026-31527
- driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
CVE-2022-48744
- net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
CVE-2023-53510
- scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
CVE-2026-23268
- apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2025-21812
- ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
CVE-2026-46266
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
CVE-2026-53228
- ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
CVE-2026-53355
- net: rds: clear i_sends on setup unwind {CVE-2026-53355}
CVE-2026-45970
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
CVE-2023-52922
- can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
CVE-2026-52920
- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

Record: CLSA-2026-1791132071
Updated: 2026-11-02

OSVCLSA-2026-1791132078 No score

Fix of 160 CVEs

CVE-2026-64375
- proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
- exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2026-90413
- IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
CVE-2026-53062
- dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
CVE-2026-64237
- Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
- Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
CVE-2026-64109
- af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
CVE-2025-38512
- wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
CVE-2025-38117
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
CVE-2026-22980
- nfsd: provide locking for v4_end_grace {CVE-2026-22980}
CVE-2023-53254
- cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
CVE-2025-37885
- KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
CVE-2026-23191
- ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
CVE-2025-37879
- 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
CVE-2023-53039
- HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
CVE-2019-12456
- scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
CVE-2024-46812
- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
CVE-2026-31761
- iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
CVE-2026-53120
- PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
CVE-2026-31598
- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
CVE-2026-43075
- ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
CVE-2024-41013
- xfs: don't walk off the end of a directory data block {CVE-2024-41013}
CVE-2026-31527
- driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
CVE-2022-48744
- net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
CVE-2023-53510
- scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
CVE-2026-23268
- apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2025-21812
- ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
CVE-2026-46266
- inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
CVE-2026-53228
- ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
CVE-2026-53355
- net: rds: clear i_sends on setup unwind {CVE-2026-53355}
CVE-2026-45970
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
CVE-2023-52922
- can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
CVE-2026-52920
- netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

Record: CLSA-2026-1791132078
Updated: 2026-11-02

OSVCLSA-2026-1791132991 No score

Fix of 400 CVEs

CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2025-39827
- net: rose: include node references in rose_neigh refcount {CVE-2025-39827}
CVE-2026-93140
- udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
CVE-2026-90112
- net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
CVE-2026-90237
- netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237}
CVE-2026-93051
- misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051}
CVE-2026-90379
- wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379}
CVE-2026-90302
- ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
CVE-2026-90383
- misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
CVE-2026-90320
- ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
CVE-2026-93047
- drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047}
CVE-2026-93192
- drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192}
CVE-2026-93050
- ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050}
CVE-2026-90311
- thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311}
CVE-2026-93191
- smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191}
CVE-2026-93042
- dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042}
CVE-2026-93056
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
CVE-2026-93203
- batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203}
CVE-2026-93204
- batman-adv: dat: atomically update mac addresses {CVE-2026-93204}
CVE-2026-90000
- HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
CVE-2026-90431
- remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
CVE-2026-93202
- i3c: master: Fix recursive locking during device registration {CVE-2026-93202}
CVE-2026-90347
- arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347}
CVE-2026-90267
- scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
CVE-2026-92500
- ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}
CVE-2026-93196
- nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
CVE-2026-90207
- ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
CVE-2026-90307
- RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
CVE-2026-90110
- inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110}
CVE-2026-90293
- IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
CVE-2026-89838
- f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
CVE-2026-93177
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177}
CVE-2026-89823
- drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
CVE-2026-90041
- HID: sony: clean up device list on probe failure {CVE-2026-90041}
CVE-2026-90015
- xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
CVE-2026-93095 -…

Record: CLSA-2026-1791132991
Updated: 2026-11-02

OSVCLSA-2026-1791852988 No score

kernel: Fix of 107 CVEs

netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
sctp: validate embedded address parameter length {CVE-2026-74287}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
smb: client: reject overlapping data areas in SMB2 responses {CVE-2026-64257}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
crypto: qat - protect interrupt mask CSRs with a spinlock {CVE-2026-64438}
crypto: qat - remove intermediate tasklet for vf2pf {CVE-2026-64438}
usb: free iso schedules on failed submit {CVE-2026-64348}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
net: tun: bound receive headroom {CVE-2026-81000}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
wifi: ath9k: hif_usb: don't dereference hif_dev after…

Record: CLSA-2026-1791852988
Updated: 2026-11-02

OSVCLSA-2026-1791858083 No score

kernel: Fix of 94 CVEs

netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
usb: free iso schedules on failed submit {CVE-2026-64348}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
net: tun: bound receive headroom {CVE-2026-81000}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet…

Record: CLSA-2026-1791858083
Updated: 2026-11-02

OSVCLSA-2026-1791946572 No score

Fix of 198 CVEs

CVE-2024-36894
- usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
CVE-2026-97447
- ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
CVE-2026-93822
- PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
CVE-2026-93826
- HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
CVE-2026-97954
- net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
CVE-2026-97949
- configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
CVE-2026-97931
- ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
CVE-2026-97940
- ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
CVE-2026-97539
- usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
CVE-2026-74510
- Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
CVE-2026-72084
- scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
CVE-2026-90302
- ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
CVE-2026-90320
- ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
CVE-2026-90321
- ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
CVE-2026-90431
- remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
CVE-2026-74637
- perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
CVE-2026-74752
- sctp: validate cookie AUTH state before use {CVE-2026-74752}
CVE-2026-74387
- ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
CVE-2026-80536
- xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
CVE-2026-89659
- NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
CVE-2026-80576
- drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
CVE-2026-90223
- nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
CVE-2026-80994
- net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
CVE-2026-72398
- sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
CVE-2026-74583
- net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
CVE-2026-72322
- ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
CVE-2026-93095
- hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
CVE-2026-72472
- nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
CVE-2026-90045
- USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
CVE-2026-90421
- PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
CVE-2026-64583
- usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
CVE-2026-68329
- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
CVE-2026-89448
- iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
CVE-2026-64001
- ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
CVE-2026-64305
- crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
CVE-2026-64348
- usb: free iso schedules on failed submit {CVE-2026-64348}
CVE-2026-64422
- net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
CVE-2026-90180
- block:…

Record: CLSA-2026-1791946572
Updated: 2026-11-02

OSVCLSA-2026-1791949745 No score

kernel: Fix of 69 CVEs

sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
wifi: libipw: reject too-short association responses {CVE-2026-98348}
net: lock the socket in sock_gettstamp() {CVE-2026-98276}
ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
sctp: validate embedded address parameter length {CVE-2026-74287}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
Squashfs: check block offset is not negative {CVE-2026-90203}
ALSA: usb-audio: fix OOB write in…

Record: CLSA-2026-1791949745
Updated: 2026-11-02

OSVCLSA-2026-1792020435 No score

kernel: Fix of 68 CVEs

sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
wifi: libipw: reject too-short association responses {CVE-2026-98348}
net: lock the socket in sock_gettstamp() {CVE-2026-98276}
ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
slip: fix use-after-free in sl_sync() {CVE-2026-81001}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
sctp: validate embedded address parameter length {CVE-2026-74287}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
Squashfs: check block offset is not negative {CVE-2026-90203}
ALSA: usb-audio: fix OOB write in…

Record: CLSA-2026-1792020435
Updated: 2026-11-02

OSVMGASA-2026-0336 No score

Updated kernel, kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages fix security vulnerabilities

Upstream kernel 6.18.44 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Record: MGASA-2026-0336
Updated: 2026-11-02

OSVMGASA-2026-0337 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.18.44 fixes vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0337
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21910-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: openSUSE-SU-2026:21910-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23477-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23477-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23481-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23481-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23528-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23528-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23529-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23529-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23881-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23881-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23887-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23887-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23897-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23897-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23902-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23902-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4120-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43014: net: macb: properly unregister fixed rate clocks (bsc#1264012).
CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
CVE-2026-53059: dm…

Record: SUSE-SU-2026:4120-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4254-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
CVE-2026-53059: dm log: fix out-of-bounds write due…

Record: SUSE-SU-2026:4254-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4282-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43134: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (bsc#1264308).
CVE-2026-43257: media: cx88: Add missing unmap in snd_cx88_hw_params() (bsc#1264296).
CVE-2026-43277: ACPI / APEI: Make GHES estatus header validation more user friendly (bsc#1264594).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45941: tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (bsc#1266920).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46108: ipmi:si: Return state to normal if message allocation fails (bsc#1267615).
CVE-2026-46128: ipmi: Check event message buffer response for bad data (bsc#1267643).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: do not use skb_mac_header() in qdisc_pkt_len_init() (bsc#1269530).
CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).
CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).
CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).
CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).
CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).
CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).
CVE-2026-53403: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in (bsc#1271731).
CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).
CVE-2026-63823: security: don't use RCU accessors for cred->session_keyring (bsc#1272182).
CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).
CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).
CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63891: thunderbolt:…

Record: SUSE-SU-2026:4282-1
Updated: 2026-11-02

OSVUSN-8875-1 No score

linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-realtime, linux-xilinx-zynqmp vulnerabilities

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)