CVE-2026-72262

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get The ipc_control_data buffer is allocated as kzalloc(max_size), where max_size covers the entire struct sof_ipc_ctrl_data including its flexible array payload. However, the bounds checks in bytes_ext_put and _bytes_ext_get compared user data lengths against max_size directly, ignoring that cdata->data sits at an offset of sizeof(struct sof_ipc_ctrl_data) bytes into the allocation. This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data on the get path. Fix all bounds checks to subtract sizeof(*cdata) from max_size so they reflect the actual space available at the cdata->data offset. Also fix the error-path restore in bytes_ext_put which wrote to cdata->data instead of cdata, causing the same overflow.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

• kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

• kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

• kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)

• kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

• kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

• kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)

• kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)

• kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

• kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)

• kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

• kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

• kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

• kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

• kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)

• kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

• kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

• kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

• kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

• kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)

• kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

• kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

• kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

• kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

• kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

• kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

• powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:Rocky Linux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

• kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

• kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)

• kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

• kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)

• kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

• kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

• kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

• kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

• powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:Rocky Linux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)

• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

• kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)

• kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)

• kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)

• kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)

• kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)

• kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)

• kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)

• kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)

• kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)

• kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)

• kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)

• kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)

• kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)

• kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)

• kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)

• kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)

• kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)

• kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Bug Fix(es) and Enhancement(s):

• cannot use VFs of i40e/ice NIC in bond device (JIRA:Rocky Linux-143410)

• ionic: commit backported to 9.8 missing in 10.2 (JIRA:Rocky Linux-165657)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get The ipc_control_data buffer is allocated as kzalloc(max_size), where max_size covers the entire struct sof_ipc_ctrl_data including its flexible array payload. However, the bounds checks in bytes_ext_put and _bytes_ext_get compared user data lengths against max_size directly, ignoring that cdata->data sits at an offset of sizeof(struct sof_ipc_ctrl_data) bytes into the allocation. This allowed writing up to sizeof(struct sof_ipc_ctrl_data) bytes past the end of the heap buffer from unprivileged userspace via the ALSA TLV kcontrol interface, and similarly allowed over-reading adjacent heap data on the get path. Fix all bounds checks to subtract sizeof(*cdata) from max_size so they reflect the actual space available at the cdata->data offset. Also fix the error-path restore in bytes_ext_put which wrote to cdata->data instead of cdata, causing the same overflow.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
• kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
• kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
• kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)
• kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
• kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
• kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
• kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)
• kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
• kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
• kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
• kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
• kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
• kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
• kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
• kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
• kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
• kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
• kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
• kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
• kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
• kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
• kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
• kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
• kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
• kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

• powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:AlmaLinux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
• kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
• kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
• kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
• kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
• kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
• kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
• kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
• kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

• powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:AlmaLinux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)
• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
• kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
• kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
• kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
• kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
• kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
• kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)
• kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
• kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
• kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
• kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)
• kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
• kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
• kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
• kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
• kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
• kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
• kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
• kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Bug Fix(es) and Enhancement(s):

• cannot use VFs of i40e/ice NIC in bond device (JIRA:AlmaLinux-143410)
• ionic: commit backported to 9.8 missing in 10.2 (JIRA:AlmaLinux-165657)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF {CVE-2026-98116}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• dm cache policy smq: check allocation under invalidate lock {CVE-2026-53265}
• RDMA/siw: Bound fragmented header copies by the remaining length {CVE-2026-98323}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
• ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• net: qrtr: ns: Fix use-after-free in driver remove() {CVE-2026-46047}
• RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043}
• gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984}
• gfs2: Add metapath_dibh helper {CVE-2026-45984}
• bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• gfs2: Fix slab-use-after-free in qd_put {CVE-2026-45861}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180}
• netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• sctp: purge outqueue on stale COOKIE-ECHO handling {CVE-2026-52924}
• ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912}
• ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• wifi: nl80211: reject oversized EMA RNR lists {CVE-2026-53182}
• netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
• ppp: require CAP_NET_ADMIN in target…

• net: bridge: fix vlan tunnel dst refcnt when egressing {CVE-2021-47222}
• net: bridge: fix vlan tunnel dst null pointer dereference {CVE-2021-47223}
• writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378}
• writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
• writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
• fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount {CVE-2026-64378}
• libceph: validate banner payload length {CVE-2026-90067}
• drm/virtio: release the GEM object on virtio_gpu_vram_create() errors {CVE-2026-98606}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs {CVE-2026-74390}
• nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685}
• vdpa_sim_blk: reject out-of-range sector starts {CVE-2026-97991}
• Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
• HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
• nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482}
• nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386}
• bpf: mark a NULL call argument precise {CVE-2026-98019}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get {CVE-2026-72262}
• ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes() {CVE-2026-72262}
• Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• fs/resctrl: Fix UAF from worker threads when domains are removed {CVE-2026-93099}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
• openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• sctp: diag: reject stale associations in dump_one path {CVE-2026-52917}
• sctp: Hold sock lock while iterating over address list {CVE-2026-52917}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• nfsd: gate nfs3…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

This update for the SUSE Linux Enterprise Kernel 6.4.0-44.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-46.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-35.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-42.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-41.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-43.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-46.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-40.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-39.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-38.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-37.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-45.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-45.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-43.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-42.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-41.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-39.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-38.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-36.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-47.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

This update for the SUSE Linux Enterprise Kernel 6.4.0-40.1 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271837).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43014: net: macb: properly unregister fixed rate clocks (bsc#1264012).
• CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
• CVE-2026-53059: dm…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
• CVE-2026-53059: dm log: fix out-of-bounds write due…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
• CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
• CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
• CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
• CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
• CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
• CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
• CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).
• CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
• CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
• CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
• CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).
• CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
• CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
• CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
• CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
• CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
• CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).
• CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
• CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
• CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
• CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).
• CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
• CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).
• CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).
• CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995).
• CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert…

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (bsc#1264642).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).
• CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
• CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
• CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
• CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
• CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
• CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
• CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).
• CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).
• CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).
• CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).
• CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
• CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
• CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
• CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).
• CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
• CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
• CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
• CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues…

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
• CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
• CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
• CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
• CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
• CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
• CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
• CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).
• CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
• CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
• CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
• CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).
• CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
• CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
• CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
• CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
• CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
• CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).
• CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
• CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
• CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
• CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).
• CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
• CVE-2026-64543: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (bsc#1273311).
• CVE-2026-64562: KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1273930).
• CVE-2026-64563: rhashtable: clear stale iter->p on table restart (bsc#1273995).
• CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error…

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.22 fixes various security issues:

The following security issues were fixed:

• CVE-2026-53016: crypto: ccp - copy IV using skcipher ivsize (bsc#1269766).
• CVE-2026-63968: ipv6: fix possible infinite loop in fib6_select_path() (bsc#1272521).
• CVE-2026-64217: netfs: Fix overrun check in netfs_extract_user_iter() (bsc#1272874).
• CVE-2026-68426: xfrm: fix stale skb->prev after async crypto steals a GSO segment (bsc#1274712).
• CVE-2026-72262: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (bsc#1277679).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1280693).
• CVE-2026-74669: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (bsc#1277399).
• CVE-2026-89544: SUNRPC: fix gssx_dec_option_array error path bugs (bsc#1280760).
• CVE-2026-89551: SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (bsc#1280728).
• CVE-2026-89674: nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (bsc#1280285).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285686).