CVE-2026-72108

dm thin metadata: fix metadata snapshot consistency on commit failure

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

dm thin metadata: fix metadata snapshot consistency on commit failure

__reserve_metadata_snap() and __release_metadata_snap() modify the superblock's held_root directly in the block_manager's buffer. If the subsequent metadata commit fails, the held_root gets flushed to disk through the abort_transaction path, resulting in inconsistent metadata.

Reproducer 1: __reserve_metadata_snap()

Create a 2 MiB metadata device and make the region after the 14th block inaccessible, to trigger metadata commit failure in the subsequent reserve_metadata_snap operation. The 14th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 112 linear /dev/sdc 0 112 3984 error"

Create a 16 MiB thin-pool

dmsetup create tdata --table "0 32768 zero" dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1 dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta
/dev/mapper/tdata 128 0 1 skip_block_zeroing"

Take a metadata snapshot to trigger metadata commit failure and transaction abort. However, the held_root is written to disk, breaking metadata consistency.

dmsetup message tpool 0 "reserve_metadata_snap"

thin_check v1.2.2 result:

Bad reference count for metadata block 6. Expected 2, but space map contains 1. Bad reference count for metadata block 7. Expected 2, but space map contains 1. Bad reference count for metadata block 13. Expected 1, but space map contains 0.

Reproducer 2: __release_metadata_snap()

Create a 2 MiB metadata device and make the region after the 16th block inaccessible, to trigger metadata commit failure in the subsequent release_metadata_snap operation. The 16th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 128 linear /dev/sdc 0 128 3968 error"

Create a 16 MiB thin-pool

Reserve then release the metadata snapshot, to trigger metadata commit failure and transaction abort. The held_root gets removed from the on-disk superblock, causing inconsistent metadata.

dmsetup message tpool 0 "reserve_metadata_snap" dmsetup message tpool 0 "release_metadata_snap"

thin_check v1.2.2 result:

Bad reference count for metadata block 6. Expected 1, but space map contains 2. Bad reference count for metadata block 7. Expected 1, but space map contains 2. 1 metadata blocks have leaked.

Fix by deferring the held_root update to commit time.

Additionally, move the existing-snapshot check in __reserve_metadata_snap before the shadow operation to avoid unnecessary work. In __release_metadata_snap, clear pmd->held_root before btree deletion so partial failure leaks blocks rather than leaving a stale reference, and unlock the snapshot block before decrementing its refcount.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.26%Unchanged since Aug 15, 2026

What each source reports

CVE List Score used 7.8

dm thin metadata: fix metadata snapshot consistency on commit failure

In the Linux kernel, the following vulnerability has been resolved:

dm thin metadata: fix metadata snapshot consistency on commit failure

Reproducer 1: __reserve_metadata_snap()

Create a 2 MiB metadata device and make the region after the 14th block inaccessible, to trigger metadata commit failure in the subsequent reserve_metadata_snap operation. The 14th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 112 linear /dev/sdc 0 112 3984 error"

Create a 16 MiB thin-pool

Take a metadata snapshot to trigger metadata commit failure and transaction abort. However, the held_root is written to disk, breaking metadata consistency.

dmsetup message tpool 0 "reserve_metadata_snap"

thin_check v1.2.2 result:

Reproducer 2: __release_metadata_snap()

Create a 2 MiB metadata device and make the region after the 16th block inaccessible, to trigger metadata commit failure in the subsequent release_metadata_snap operation. The 16th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 128 linear /dev/sdc 0 128 3968 error"

Create a 16 MiB thin-pool

Reserve then release the metadata snapshot, to trigger metadata commit failure and transaction abort. The held_root gets removed from the on-disk superblock, causing inconsistent metadata.

dmsetup message tpool 0 "reserve_metadata_snap" dmsetup message tpool 0 "release_metadata_snap"

thin_check v1.2.2 result:

Bad reference count for metadata block 6. Expected 1, but space map contains 2. Bad reference count for metadata block 7. Expected 1, but space map contains 2. 1 metadata blocks have leaked.

Fix by deferring the held_root update to commit time.

Record: CVE-2026-72108
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-672
Updated: 2026-11-02

EUVDEUVD-2026-59066 7.8

In the Linux kernel, the following vulnerability has been resolved:

dm thin metadata: fix metadata snapshot consistency on commit failure

Reproducer 1: __reserve_metadata_snap()

Create a 2 MiB metadata device and make the region after the 14th block inaccessible, to trigger metadata commit failure in the subsequent reserve_metadata_snap operation. The 14th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 112 linear /dev/sdc 0 112 3984 error"

Create a 16 MiB thin-pool

Take a metadata snapshot to trigger metadata commit failure and transaction abort. However, the held_root is written to disk, breaking metadata consistency.

dmsetup message tpool 0 "reserve_metadata_snap"

thin_check v1.2.2 result:

Reproducer 2: __release_metadata_snap()

Create a 2 MiB metadata device and make the region after the 16th block inaccessible, to trigger metadata commit failure in the subsequent release_metadata_snap operation. The 16th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 128 linear /dev/sdc 0 128 3968 error"

Create a 16 MiB thin-pool

Reserve then release the metadata snapshot, to trigger metadata commit failure and transaction abort. The held_root gets removed from the on-disk superblock, causing inconsistent metadata.

dmsetup message tpool 0 "reserve_metadata_snap" dmsetup message tpool 0 "release_metadata_snap"

thin_check v1.2.2 result:

Bad reference count for metadata block 6. Expected 1, but space map contains 2. Bad reference count for metadata block 7. Expected 1, but space map contains 2. 1 metadata blocks have leaked.

Fix by deferring the held_root update to commit time.

Record: EUVD-2026-59066
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j64h-56wh-mxm7 7.8

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix...

In the Linux kernel, the following vulnerability has been resolved:

dm thin metadata: fix metadata snapshot consistency on commit failure

Reproducer 1: __reserve_metadata_snap()

Create a 2 MiB metadata device and make the region after the 14th block inaccessible, to trigger metadata commit failure in the subsequent reserve_metadata_snap operation. The 14th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 112 linear /dev/sdc 0 112 3984 error"

Create a 16 MiB thin-pool

Take a metadata snapshot to trigger metadata commit failure and transaction abort. However, the held_root is written to disk, breaking metadata consistency.

dmsetup message tpool 0 "reserve_metadata_snap"

thin_check v1.2.2 result:

Reproducer 2: __release_metadata_snap()

Create a 2 MiB metadata device and make the region after the 16th block inaccessible, to trigger metadata commit failure in the subsequent release_metadata_snap operation. The 16th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 128 linear /dev/sdc 0 128 3968 error"

Create a 16 MiB thin-pool

Reserve then release the metadata snapshot, to trigger metadata commit failure and transaction abort. The held_root gets removed from the on-disk superblock, causing inconsistent metadata.

dmsetup message tpool 0 "reserve_metadata_snap" dmsetup message tpool 0 "release_metadata_snap"

thin_check v1.2.2 result:

Bad reference count for metadata block 6. Expected 1, but space map contains 2. Bad reference count for metadata block 7. Expected 1, but space map contains 2. 1 metadata blocks have leaked.

Fix by deferring the held_root update to commit time.

Record: GHSA-j64h-56wh-mxm7
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-672
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

dm thin metadata: fix metadata snapshot consistency on commit failure

Reproducer 1: __reserve_metadata_snap()

Create a 2 MiB metadata device and make the region after the 14th block inaccessible, to trigger metadata commit failure in the subsequent reserve_metadata_snap operation. The 14th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 112 linear /dev/sdc 0 112 3984 error"

Create a 16 MiB thin-pool

Take a metadata snapshot to trigger metadata commit failure and transaction abort. However, the held_root is written to disk, breaking metadata consistency.

dmsetup message tpool 0 "reserve_metadata_snap"

thin_check v1.2.2 result:

Reproducer 2: __release_metadata_snap()

Create a 2 MiB metadata device and make the region after the 16th block inaccessible, to trigger metadata commit failure in the subsequent release_metadata_snap operation. The 16th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 128 linear /dev/sdc 0 128 3968 error"

Create a 16 MiB thin-pool

Reserve then release the metadata snapshot, to trigger metadata commit failure and transaction abort. The held_root gets removed from the on-disk superblock, causing inconsistent metadata.

dmsetup message tpool 0 "reserve_metadata_snap" dmsetup message tpool 0 "release_metadata_snap"

thin_check v1.2.2 result:

Bad reference count for metadata block 6. Expected 1, but space map contains 2. Bad reference count for metadata block 7. Expected 1, but space map contains 2. 1 metadata blocks have leaked.

Fix by deferring the held_root update to commit time.

Record: CVE-2026-72108
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-672
Updated: 2026-11-02

OSVBELL-CVE-2026-72108 7.8

Record: BELL-CVE-2026-72108
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

dm thin metadata: fix metadata snapshot consistency on commit failure

In the Linux kernel, the following vulnerability has been resolved:

dm thin metadata: fix metadata snapshot consistency on commit failure

Reproducer 1: __reserve_metadata_snap()

Create a 2 MiB metadata device and make the region after the 14th block inaccessible, to trigger metadata commit failure in the subsequent reserve_metadata_snap operation. The 14th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 112 linear /dev/sdc 0 112 3984 error"

Create a 16 MiB thin-pool

Take a metadata snapshot to trigger metadata commit failure and transaction abort. However, the held_root is written to disk, breaking metadata consistency.

dmsetup message tpool 0 "reserve_metadata_snap"

thin_check v1.2.2 result:

Reproducer 2: __release_metadata_snap()

Create a 2 MiB metadata device and make the region after the 16th block inaccessible, to trigger metadata commit failure in the subsequent release_metadata_snap operation. The 16th block will be the shadow destination for the index block.

dmsetup create tmeta --table "0 128 linear /dev/sdc 0 128 3968 error"

Create a 16 MiB thin-pool

Reserve then release the metadata snapshot, to trigger metadata commit failure and transaction abort. The held_root gets removed from the on-disk superblock, causing inconsistent metadata.

dmsetup message tpool 0 "reserve_metadata_snap" dmsetup message tpool 0 "release_metadata_snap"

thin_check v1.2.2 result:

Bad reference count for metadata block 6. Expected 1, but space map contains 2. Bad reference count for metadata block 7. Expected 1, but space map contains 2. 1 metadata blocks have leaked.

Fix by deferring the held_root update to commit time.

Record: CVE-2026-72108
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 34 moreShow less

OSVDEBIAN-CVE-2026-72108 7.8

In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure __reserve_metadata_snap() and __release_metadata_snap() modify the superblock's held_root directly in the block_manager's buffer. If the subsequent metadata commit fails, the held_root gets flushed to disk through the abort_transaction path, resulting in inconsistent metadata. Reproducer 1: __reserve_metadata_snap() 1. Create a 2 MiB metadata device and make the region after the 14th block inaccessible, to trigger metadata commit failure in the subsequent reserve_metadata_snap operation. The 14th block will be the shadow destination for the index block. dmsetup create tmeta --table "0 112 linear /dev/sdc 0 112 3984 error" 2. Create a 16 MiB thin-pool dmsetup create tdata --table "0 32768 zero" dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1 dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \ /dev/mapper/tdata 128 0 1 skip_block_zeroing" 3. Take a metadata snapshot to trigger metadata commit failure and transaction abort. However, the held_root is written to disk, breaking metadata consistency. dmsetup message tpool 0 "reserve_metadata_snap" thin_check v1.2.2 result: Bad reference count for metadata block 6. Expected 2, but space map contains 1. Bad reference count for metadata block 7. Expected 2, but space map contains 1. Bad reference count for metadata block 13. Expected 1, but space map contains 0. Reproducer 2: __release_metadata_snap() 1. Create a 2 MiB metadata device and make the region after the 16th block inaccessible, to trigger metadata commit failure in the subsequent release_metadata_snap operation. The 16th block will be the shadow destination for the index block. dmsetup create tmeta --table "0 128 linear /dev/sdc 0 128 3968 error" 2. Create a 16 MiB thin-pool dmsetup create tdata --table "0 32768 zero" dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1 dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \ /dev/mapper/tdata 128 0 1 skip_block_zeroing" 3. Reserve then release the metadata snapshot, to trigger metadata commit failure and transaction abort. The held_root gets removed from the on-disk superblock, causing inconsistent metadata. dmsetup message tpool 0 "reserve_metadata_snap" dmsetup message tpool 0 "release_metadata_snap" thin_check v1.2.2 result: Bad reference count for metadata block 6. Expected 1, but space map contains 2. Bad reference count for metadata block 7. Expected 1, but space map contains 2. 1 metadata blocks have leaked. Fix by deferring the held_root update to commit time. Additionally, move the existing-snapshot check in __reserve_metadata_snap before the shadow operation to avoid unnecessary work. In __release_metadata_snap, clear pmd->held_root before btree deletion so partial failure leaks blocks rather than leaving a stale reference, and unlock the snapshot block before decrementing its refcount.

Record: DEBIAN-CVE-2026-72108
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-4039 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:ALSA: caiaq: Use snd_card_free_when_closed() at disconnectionThe USB disconnect callback is supposed to be short and not too-longwaiting. OTOH, the current code uses snd_card_free() atdisconnection, but this waits for the close of all used fds, hence itcan take long. It eventually blocks the upper layer USB ioctls, whichmay trigger a soft lockup.An easy workaround is to replace snd_card_free() withsnd_card_free_when_closed(). This variant returns immediately whilethe release of resources is done asynchronously by the card devicerelease at the last close.This patch also splits the code to the disconnect and the free phases;the former is called immediately at the USB disconnect callback whilethe latter is called from the card destructor.(CVE-2024-56531)

In the Linux kernel, the following vulnerability has been resolved:xsk: fix OOB map writes when deleting elementsJordy says: In the xsk_map_delete_elem function an unsigned integer(map->max_entries) is compared with a user-controlled signed integer(k). Due to implicit type conversion, a large unsigned value formap->max_entries can bypass the intended bounds check: if (k >= map->max_entries) return -EINVAL;This allows k to hold a negative value (between -2147483648 and -2),which is then used as an array index in m->xsk_map[k], which resultsin an out-of-bounds access. spin_lock_bh(&m->lock); map_entry = &m->xsk_map[k]; // Out-of-bounds map_entry old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write if (old_xs) xsk_map_sock_delete(old_xs, map_entry); spin_unlock_bh(&m->lock);The xchg operation can then be used to cause an out-of-bounds write.Moreover, the invalid map_entry passed to xsk_map_sock_delete can leadto further memory corruption. It indeed results in following splat:[76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108[76612.904330] #PF: supervisor write access in kernel mode[76612.909639] #PF: error_code(0x0002) - not-present page[76612.914855] PGD 0 P4D 0[76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP[76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470[76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019[76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60[76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff <48> 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31[76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246[76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000[76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000[76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007[76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8[76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0[76613.005303] FS: 00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000[76613.013517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0[76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000[76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400[76613.041086] PKRU: 55555554[76613.043842] Call Trace:[76613.046331] <TASK>[76613.048468] ? __die+0x20/0x60[76613.051581] ? page_fault_oops+0x15a/0x450[76613.055747] ? search_extable+0x22/0x30[76613.059649] ? search_bpf_extables+0x5f/0x80[76613.063988] ? exc_page_fault+0xa9/0x140[76613.067975] ? asm_exc_page_fault+0x22/0x30[76613.072229] ? xsk_map_delete_elem+0x2d/0x60[76613.076573] ? xsk_map_delete_elem+0x23/0x60[76613.080914] …

Record: OESA-2026-4039
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-72108 7.8

Record: UBUNTU-CVE-2026-72108
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVCLSA-2026-1792977831 No score

kernel: Fix of 118 CVEs

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284}
usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
usb: usbfs: fix use-after-free of usb_device in usbdev_release() {CVE-2026-80824}
HID: alps: fix use-after-free on input2 registration failure {CVE-2026-98501}
scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() {CVE-2023-53754}
net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}
net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488}
net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489}
net: ena: fix MMIO read buffer leak on probe failure {CVE-2026-98486}
HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}
RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965}
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}
net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377}
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
ALSA: usbusx2y: validate URB actual_length in interrupt callback {CVE-2026-97929}
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf {CVE-2026-97930}
udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
wifi: iwlwifi: mvm: validate TX_CMD response layout {CVE-2026-93793}
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid {CVE-2026-97561}
wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345}
IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294}
NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151}
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed {CVE-2026-98359}
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates {CVE-2026-98099}
wifi: cfg80211: reject duplicate wiphy cipher suite entries {CVE-2026-97518}
IB/iser: reject a remote invalidation of an unregistered direction {CVE-2026-98358}
ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
ACPI: bus: Introduce acpi_bus_get_primary_device() {CVE-2026-93251}
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
smb: client: reject a tree connect response whose byte count is too small {CVE-2026-89631}
tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847}
fsnotify: Fix stale object mask after concurrent mark updates {CVE-2026-89595}
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638}
sunrpc: init…

Record: CLSA-2026-1792977831
Updated: 2026-11-02

OSVCLSA-2026-1792979087 No score

kernel: Fix of 118 CVEs

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284}
usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
usb: usbfs: fix use-after-free of usb_device in usbdev_release() {CVE-2026-80824}
HID: alps: fix use-after-free on input2 registration failure {CVE-2026-98501}
scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() {CVE-2023-53754}
net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}
net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488}
net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489}
net: ena: fix MMIO read buffer leak on probe failure {CVE-2026-98486}
HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}
RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965}
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}
net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377}
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
ALSA: usbusx2y: validate URB actual_length in interrupt callback {CVE-2026-97929}
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf {CVE-2026-97930}
udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
wifi: iwlwifi: mvm: validate TX_CMD response layout {CVE-2026-93793}
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid {CVE-2026-97561}
wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345}
IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294}
NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151}
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed {CVE-2026-98359}
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates {CVE-2026-98099}
wifi: cfg80211: reject duplicate wiphy cipher suite entries {CVE-2026-97518}
IB/iser: reject a remote invalidation of an unregistered direction {CVE-2026-98358}
ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
ACPI: bus: Introduce acpi_bus_get_primary_device() {CVE-2026-93251}
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
smb: client: reject a tree connect response whose byte count is too small {CVE-2026-89631}
tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847}
fsnotify: Fix stale object mask after concurrent mark updates {CVE-2026-89595}
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638}
sunrpc: init…

Record: CLSA-2026-1792979087
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21910-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: openSUSE-SU-2026:21910-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23881-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23881-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23887-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23887-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23897-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23897-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23902-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23902-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24181-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). -…

Record: SUSE-SU-2026:24181-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24182-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c:…

Record: SUSE-SU-2026:24182-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24315-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). -…

Record: SUSE-SU-2026:24315-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24316-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c:…

Record: SUSE-SU-2026:24316-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4282-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43134: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (bsc#1264308).
CVE-2026-43257: media: cx88: Add missing unmap in snd_cx88_hw_params() (bsc#1264296).
CVE-2026-43277: ACPI / APEI: Make GHES estatus header validation more user friendly (bsc#1264594).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45941: tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (bsc#1266920).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46108: ipmi:si: Return state to normal if message allocation fails (bsc#1267615).
CVE-2026-46128: ipmi: Check event message buffer response for bad data (bsc#1267643).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: do not use skb_mac_header() in qdisc_pkt_len_init() (bsc#1269530).
CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).
CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).
CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).
CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).
CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).
CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).
CVE-2026-53403: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in (bsc#1271731).
CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).
CVE-2026-63823: security: don't use RCU accessors for cred->session_keyring (bsc#1272182).
CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).
CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).
CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63891: thunderbolt:…

Record: SUSE-SU-2026:4282-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4640-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64373: cpufreq: Fix hotplug-suspend race during…

Record: SUSE-SU-2026:4640-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4706-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64373: cpufreq: Fix hotplug-suspend race during…

Record: SUSE-SU-2026:4706-1
Updated: 2026-11-02

OSVUSN-8875-1 No score

linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-realtime, linux-xilinx-zynqmp vulnerabilities

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)