CVE-2026-74556

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer. Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)

• kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)

• kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

• kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

• kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

• kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)

• kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)

• kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)

• kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)

• kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)

• kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)

• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)

• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

• kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)

• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)

• kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)

• kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)

• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

• kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)

• kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923)

• kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)

• kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)

• kernel: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVE-2026-72045)

• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

Bug Fix(es) and Enhancement(s):

• gfs2: bufdata leaks [rhel-9.8.z] (JIRA:Rocky Linux-178223)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)

• kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)

• kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)

• kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)

• kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)

• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)

• kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)

• kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)

• kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)

• kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)

• kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)

• kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)

• kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)

• kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)

• kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)

• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)

• kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)

• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)

• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)

• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)

• kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)

• kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)

• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)

• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

Bug Fix(es) and Enhancement(s):

• [rhel-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:Rocky Linux-245035)

• RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:Rocky Linux-255233)

• [Rocky Linux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:Rocky Linux-255348)

• [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [Rocky Linux-10.2.z] (JIRA:Rocky Linux-256731)

• RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:Rocky Linux-256890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer. The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer. Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)
• kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)
• kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
• kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
• kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
• kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
• kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161)
• kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address (CVE-2025-71127)
• kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133)
• kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947)
• kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182)
• kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
• kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117)
• kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363)
• kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
• kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098)
• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)
• kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015)
• kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923)
• kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143)
• kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
• kernel: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVE-2026-72045)
• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

Bug Fix(es) and Enhancement(s):

• gfs2: bufdata leaks [almalinux-9.8.z] (JIRA:AlmaLinux-178223)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
• kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745)
• kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466)
• kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479)
• kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
• kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
• kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656)
• kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539)
• kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248)
• kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368)
• kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
• kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
• kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
• kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131)
• kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246)
• kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
• kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)
• kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
• kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
• kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
• kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr() (CVE-2026-64111)
• kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264)
• kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
• kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)

Bug Fix(es) and Enhancement(s):

• [almalinux-10.2.z]- Backport MSHV patches for hypervisor OOM handling (JIRA:AlmaLinux-245035)
• RHIVOS - [backport] S32G Driver Enablement - ADC (JIRA:AlmaLinux-255233)
• [AlmaLinux10.2z] watchdog: System can panic during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255348)
• [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [AlmaLinux-10.2.z] (JIRA:AlmaLinux-256731)
• RHIVOS - [backport] S32G Driver Update - ADC, I2C, and eDMA (JIRA:AlmaLinux-256890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer

iscsi_tcp_hdr_dissect() receives the data segment of several PDU types into the fixed-size conn->data buffer, which is allocated for ISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes. For the LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU whose DataSegmentLength exceeds that buffer.

The SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its data segment (sense/response data) into conn->data via iscsi_tcp_data_recv_prep(), but it does so without the same check. The only upstream bound on in.datalen is conn->max_recv_dlength, the initiator's advertised MaxRecvDataSegmentLength, which is commonly negotiated well above 8192 (open-iscsi defaults to 262144). A target that returns a SCSI Response with a DataSegmentLength between 8193 and max_recv_dlength therefore overflows the 8192-byte conn->data buffer.

Once the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly like those responses: bound the data segment, receive it into conn->data when present, and otherwise complete the PDU with no data. Fold the opcode into that case group rather than duplicating the check.

• drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251}
• amd/amdkfd: sync all devices to wait all processes being evicted {CVE-2024-36949}
• Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted {CVE-2024-36909}
• Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl {CVE-2024-36912}
• xfs: save ailp before dropping the AIL lock in push callbacks {CVE-2026-31454}
• net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak {CVE-2026-43041}
• netfilter: nf_conntrack: destroy stale expectfn expectations on unregister {CVE-2026-53349}
• cifs: avoid NULL pointer dereference in dbg call {CVE-2025-37844}
• fs/notify: call exportfs_encode_fid with s_umount {CVE-2025-40237}
• cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258}
• pstore/ram: fix buffer overflow in persistent_ram_save_old() {CVE-2026-46253}
• Bluetooth: ISO: fix iso_conn related locking and validity issues {CVE-2023-54164}
• netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873}
• ext4: always drain queued discard work in ext4_mb_release() {CVE-2026-43065}
• ipvs: Defer ip_vs_ftp unregister during netns cleanup {CVE-2025-40018}
• Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
• sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto {CVE-2025-40281}
• fscache: Use wait_on_bit() to wait for the freeing of relinquished volume {CVE-2023-52982}
• libceph: prevent potential out-of-bounds reads in process_message_header() {CVE-2026-43406}
• netfilter: nf_tables: reject immediate NF_QUEUE verdict {CVE-2026-43024}
• ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() {CVE-2025-68261}
• bpf, sockmap: Fix af_unix iter deadlock {CVE-2026-53035}
• sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
• netfilter: xt_CT: drop pending enqueued packets on template removal {CVE-2026-23391}
• netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457}
• libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407}
• af_unix: read UNIX_DIAG_VFS data under unix_state_lock {CVE-2026-31673}
• jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted {CVE-2025-68337}
• Bluetooth: Fix NULL pointer deference on eir_get_service_data {CVE-2025-38304}
• net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption {CVE-2026-31533}
• fsnotify: do not generate ACCESS/MODIFY events on child for special files {CVE-2025-68788}
• isofs: validate Rock Ridge CE continuation extent against volume size {CVE-2026-46303}
• net: strparser: fix skb_head leak in strp_abort_strp() {CVE-2026-46102}
• sctp: fix uninit-value in __sctp_rcv_asconf_lookup() {CVE-2026-53225}
• xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
• xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
• bpf: tcp: fix double sock release on batch realloc {CVE-2026-64575}
• bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714}
• bpf: tcp: Avoid socket skips and repeats during iteration {CVE-2026-74714}
• bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items {CVE-2026-74714}
• bpf: tcp: Get rid of st_bucket_done {CVE-2026-74714}
• bpf: tcp: Make sure iter->batch always contains a full bucket snapshot {CVE-2026-64575}
• bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch {CVE-2026-74714}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689}
• net: add copy_safe_from_sockptr() helper {CVE-2026-74689}
• xfs: close crash window in attr dabtree…

• CVE-2025-39826
  • net: rose: convert 'use' field to refcount_t {CVE-2025-39826}
• CVE-2025-40146
  • blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
• CVE-2024-53216
  • nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
• CVE-2026-89778
  • isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• CVE-2026-23050
  • pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
• CVE-2025-68796
  • f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796}
• CVE-2025-68330
  • iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
• CVE-2025-40333
  • f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
• CVE-2025-40160
  • xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
• CVE-2023-54047
  • drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
• CVE-2025-68190
  • drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
• CVE-2025-68188
  • tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
• CVE-2026-89786
  • ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• CVE-2022-50764
  • ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
• CVE-2026-80785
  • fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
• CVE-2026-80788
  • nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788}
• CVE-2026-80747
  • drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}
• CVE-2026-80907
  • drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
• CVE-2026-80908
  • drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
• CVE-2026-80812
  • ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
• CVE-2026-80948
  • wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
• CVE-2025-40137
  • f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
• CVE-2023-54150
  • drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
• CVE-2026-89784
  • SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
• CVE-2026-89783
  • xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
• CVE-2026-89780
  • net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780}
• CVE-2026-89777
  • vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777}
• CVE-2026-89789
  • gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
• CVE-2025-68797
  • char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
• CVE-2025-68767
  • hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
• CVE-2026-63961
  • usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961}
• CVE-2026-63904
  • usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
• CVE-2022-50864
  • nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
• CVE-2025-68771
  • ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
• CVE-2025-68750
  • usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
• CVE-2026-80909
  • drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909}
• CVE-2026-74402
  • crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} *…

• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
• ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}
• nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
• RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
• nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
• ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
• tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
• sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
• bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• mpls: reload header after pskb_may_pull() {CVE-2026-89555}
• net: tun: bound receive headroom {CVE-2026-81000}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• firewire: net: remove unused variable 'guid' {CVE-2023-53432}
• gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760}
• gfs2: fix kernel…

• drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818}
• drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199}
• drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199}
• drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230}
• drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230}
• openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165}
• openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678}
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs {CVE-2026-74642}
• ALSA: usb-audio: fix use-after-free in ump_to_endpoint() {CVE-2026-74501}
• NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• exec: do_close_on_exec() before taking exec_update_lock {CVE-2026-64371}
• proc: Fix broken error paths for namespace links {CVE-2026-64371}
• proc: protect ptrace_may_access() with exec_update_lock (part 1) {CVE-2026-64371}
• ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes {CVE-2026-74503}
• ALSA: timer: Forcibly close timer instances at closing {CVE-2026-53193}
• usb: typec: ucsi: Fix race condition and ordering in port unregistration {CVE-2026-74441}
• arp: do not assume dev_hard_header() does not change skb->head {CVE-2026-22988}
• netfilter: nft_ct: fix use-after-free in timeout object destroy {CVE-2026-31665}
• md/raid10: fix writes_pending and barrier reference leaks on discard failures {CVE-2026-72438}
• md/raid10: fix deadlock with check operation and nowait requests {CVE-2026-46050}
• mm: introduce and use {pgd,p4d}_populate_kernel() {CVE-2025-39844}
• vsock/virtio: fix zerocopy completion for multi-skb sends {CVE-2026-53365}
• vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting {CVE-2026-52994}
• mm: do file ownership checks with the proper mount idmap {CVE-2026-64294}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths {CVE-2026-45870}
• Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig {CVE-2026-53208}
• slip: bound decode() reads against the compressed packet length {CVE-2026-45843}
• net: tls: fix strparser anchor skb leak on offload RX setup failure {CVE-2026-52974}
• netfilter: nf_tables: unconditionally bump set->nelems before insertion {CVE-2026-23272}
• rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131}
• netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() {CVE-2026-23458}
• mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr {CVE-2025-21938}
• bpf: Fix NULL deref in map_kptr_match_type for scalar regs {CVE-2026-53032}
• bpf: Explicitly check accesses to bpf_sock_addr {CVE-2025-40078}
• nexthop: Forbid FDB status change while nexthop is in a group {CVE-2025-39980}
• bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN {CVE-2026-31525}
• x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() {CVE-2025-21913}
• ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() {CVE-2024-57994}
• drm/i915/vrr: require valid min/max vfreq for VRR {CVE-2026-68254}
• libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954}
• gfs2: prevent NULL pointer dereference during unmount {CVE-2026-53048}
• smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path {CVE-2026-31708}
• ext4: reject mount if bigalloc with s_first_data_block != 0 {CVE-2026-31447}
• NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324}
• netfilter: x_tables: guard option walkers against 1-byte tail reads {CVE-2026-43452}
• smb: client: Fix refcount leak for cifs_sb_tlink {CVE-2025-40103}
• smb: client: harden POSIX SID length parsing {CVE-2026-64380}
• crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
• bpf: Allow LPM map access from sleepable…

• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
• RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
• nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
• enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
• smb: client: reject overlapping data areas in SMB2 responses {CVE-2026-64257}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
• crypto: qat - protect interrupt mask CSRs with a spinlock {CVE-2026-64438}
• crypto: qat - remove intermediate tasklet for vf2pf {CVE-2026-64438}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
• sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
• mpls: reload header after pskb_may_pull() {CVE-2026-89555}
• net: tun: bound receive headroom {CVE-2026-81000}
• bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• wifi: ath9k: hif_usb: don't dereference hif_dev after…

• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
• RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
• nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• net: tun: bound receive headroom {CVE-2026-81000}
• bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• mpls: reload header after pskb_may_pull() {CVE-2026-89555}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2024-36894
  • usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
• CVE-2026-97447
  • ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
• CVE-2026-93822
  • PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
• CVE-2026-93826
  • HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• CVE-2026-97954
  • net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
• CVE-2026-97949
  • configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• CVE-2026-97931
  • ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• CVE-2026-97940
  • ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• CVE-2026-97539
  • usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• CVE-2026-74510
  • Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• CVE-2026-72084
  • scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-90321
  • ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-74637
  • perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• CVE-2026-74752
  • sctp: validate cookie AUTH state before use {CVE-2026-74752}
• CVE-2026-74387
  • ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• CVE-2026-80536
  • xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• CVE-2026-89659
  • NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• CVE-2026-80576
  • drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• CVE-2026-90223
  • nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
• CVE-2026-80994
  • net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• CVE-2026-72398
  • sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• CVE-2026-74583
  • net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• CVE-2026-72322
  • ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• CVE-2026-93095
  • hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
• CVE-2026-72472
  • nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-90421
  • PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• CVE-2026-64583
  • usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
• CVE-2026-68329
  • iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
• CVE-2026-89448
  • iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• CVE-2026-64001
  • ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
• CVE-2026-64305
  • crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• CVE-2026-64348
  • usb: free iso schedules on failed submit {CVE-2026-64348}
• CVE-2026-64422
  • net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• CVE-2026-90180
  • block:…

• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
• wifi: libipw: reject too-short association responses {CVE-2026-98348}
• net: lock the socket in sock_gettstamp() {CVE-2026-98276}
• ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
• wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
• wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• ALSA: usb-audio: fix OOB write in…

• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364}
• wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
• wifi: libipw: reject too-short association responses {CVE-2026-98348}
• net: lock the socket in sock_gettstamp() {CVE-2026-98276}
• ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266}
• wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
• wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• ALSA: usb-audio: fix OOB write in…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• dm array: validate array block headers on read {CVE-2026-89574}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• nvmet-rdma: handle inline…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• dm array: validate array block headers on read {CVE-2026-89574}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• nvmet-rdma: handle inline…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189}
• ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• dm array: validate array block headers on read {CVE-2026-89574}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• slip: fix use-after-free in sl_sync() {CVE-2026-81001}
• dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575}
• net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• dmaengine: Fix possible use after free {CVE-2026-72476}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946}
• nvmet-rdma: handle inline…

• Bump kernel ABI to 30: ship the ELS kernel as 4.19.0-30-*, distinct from the prior 4.19.0-29.
• CVE-2021-3493
  • vfs: move cap_convert_nscap() call into vfs_setxattr() {CVE-2021-3493}
  • ecryptfs: fix uid translation for setxattr on security.capability {CVE-2021-3493}
• CVE-2025-23142
  • sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
• CVE-2025-38352
  • posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-52955
  • libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
• CVE-2026-53091
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2026-63814
  • f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814}
• CVE-2026-63815
  • f2fs: bound i_inline_xattr_size for non-inline-xattr inodes {CVE-2026-63815}
• CVE-2026-63922
  • ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• CVE-2026-63962
  • usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962}
• CVE-2026-64001
  • ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
• CVE-2026-64009
  • xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
• CVE-2026-64011
  • nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011}
• CVE-2026-64372
  • cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372}
• CVE-2026-64378
  • writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
  • writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
• CVE-2026-64381
  • smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381}
• CVE-2026-64471
  • Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• CVE-2026-64483
  • ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• CVE-2026-64504
  • iio: accel: bmc150: clamp the device-reported FIFO frame count {CVE-2026-64504}
• CVE-2026-64505
  • usb: gadget: function: rndis: add length check for header {CVE-2026-64505}
• CVE-2026-64541
  • net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket {CVE-2026-64541}
• CVE-2026-64543
  • tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543}
• CVE-2026-64546
  • drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• CVE-2026-64563
  • rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• CVE-2026-64564
  • sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• CVE-2026-72389
  • bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• CVE-2026-74444
  • drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• CVE-2026-74454
  • drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size {CVE-2026-74454}
• CVE-2026-74469
  • sctp: prevent peer transport count overflow {CVE-2026-74469}
• CVE-2026-74479
  • net: pktgen: fix proc entry use-after-free {CVE-2026-74479}
• CVE-2026-74498
  • ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498}
• CVE-2026-74499
  • ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() …

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
• CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
• CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
• CVE-2026-53096: bpf: Use RCU-safe iteration in…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
• CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
• CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
• CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
• CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43014: net: macb: properly unregister fixed rate clocks (bsc#1264012).
• CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
• CVE-2026-53059: dm…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
• CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
• CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
• CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
• CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
• CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
• CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
• CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
• CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
• CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
• CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
• CVE-2026-53059: dm log: fix out-of-bounds write due…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2023-53109: net: tunnels: annotate lockless accesses to dev->needed_headroom (bsc#1242405 bsc#1275784).
• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).
• CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
• CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
• CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
• CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
• CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
• CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
• CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
• CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).
• CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
• CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
• CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
• CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).
• CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
• CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
• CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
• CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
• CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
• CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).
• CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
• CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
• CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
• CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).
• CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
• CVE-2026-64543: tipc: fix use-after-free of…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
• CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
• CVE-2026-43134: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ (bsc#1264308).
• CVE-2026-43257: media: cx88: Add missing unmap in snd_cx88_hw_params() (bsc#1264296).
• CVE-2026-43277: ACPI / APEI: Make GHES estatus header validation more user friendly (bsc#1264594).
• CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
• CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
• CVE-2026-45941: tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure (bsc#1266920).
• CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
• CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
• CVE-2026-46108: ipmi:si: Return state to normal if message allocation fails (bsc#1267615).
• CVE-2026-46128: ipmi: Check event message buffer response for bad data (bsc#1267643).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
• CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
• CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
• CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
• CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
• CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
• CVE-2026-53091: net: do not use skb_mac_header() in qdisc_pkt_len_init() (bsc#1269530).
• CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
• CVE-2026-53219: netfilter: x_tables: avoid leaking percpu counter pointers (bsc#1269686).
• CVE-2026-53220: netfilter: revalidate bridge ports (bsc#1269381).
• CVE-2026-53223: net: guard timestamp cmsgs to real error queue skbs (bsc#1269301).
• CVE-2026-53228: ipv6: sit: reload inner IPv6 header after GSO offloads (bsc#1269256).
• CVE-2026-53238: netlabel: validate unlabeled address and mask attribute lengths (bsc#1269774).
• CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
• CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison (bsc#1269815).
• CVE-2026-53403: fbdev: Fix fb_new_modelist to prevent null-ptr-deref in (bsc#1271731).
• CVE-2026-63810: block: Avoid mounting the bdev pseudo-filesystem in userspace (bsc#1272297).
• CVE-2026-63823: security: don't use RCU accessors for cred->session_keyring (bsc#1272182).
• CVE-2026-63860: RDMA/core: Prefer NLA_NUL_STRING (bsc#1272429).
• CVE-2026-63868: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (bsc#1272497).
• CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63891: thunderbolt:…

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2023-53109: net: tunnels: annotate lockless accesses to dev->needed_headroom (bsc#1242405 bsc#1275784).
• CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).
• CVE-2026-53260: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req() (bsc#1269731).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
• CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
• CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
• CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
• CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
• CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
• CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
• CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).
• CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
• CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
• CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
• CVE-2026-64047: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (bsc#1273060).
• CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
• CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
• CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
• CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
• CVE-2026-64268: RDMA/siw: bound Read Response placement to the RREAD length (bsc#1273276).
• CVE-2026-64304: crypto: qat - validate RSA CRT component lengths (bsc#1273944).
• CVE-2026-64355: bpf: Reject fragmented frames in devmap (bsc#1273422).
• CVE-2026-64423: ipv4: igmp: remove multicast group from hash table on device destruction (bsc#1274274).
• CVE-2026-64450: tipc: fix out-of-bounds read in broadcast Gap ACK blocks (bsc#1273523).
• CVE-2026-64481: ALSA: hda/cs35l41: Fix firmware load work teardown (bsc#1274547).
• CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (bsc#1273303).
• CVE-2026-64543: tipc: fix use-after-free of the…

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
• CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
• CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604).
• CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072).
• CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (bsc#1264642).
• CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734).
• CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
• CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
• CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
• CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
• CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
• CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985).
• CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (bsc#1269306).
• CVE-2026-53264: net/sched: act_api: use RCU with deferred freeing for action lifecycle (bsc#1269238).
• CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends (bsc#1271365).
• CVE-2026-53381: virtiofs: fix UAF on submount umount (bsc#1271830).
• CVE-2026-63801: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (bsc#1272230).
• CVE-2026-63823: keys: Pin request_key_auth payload in instantiate paths (bsc#1272182).
• CVE-2026-63827: apparmor: fix use-after-free in rawdata dedup loop (bsc#1272179).
• CVE-2026-63879: drm/amdgpu: fix amdgpu_hmm_range_get_pages (bsc#1272569).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63887: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (bsc#1272385).
• CVE-2026-63888: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (bsc#1272390).
• CVE-2026-63920: ipv6: validate extension header length before copying to cmsg (bsc#1272877).
• CVE-2026-63944: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (bsc#1272662).
• CVE-2026-63970: vsock/virtio: bind uarg before filling zerocopy skb (bsc#1272673).
• CVE-2026-63992: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (bsc#1272868).
• CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling (bsc#1273030).
• CVE-2026-64002: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (bsc#1273774).
• CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (bsc#1273105).
• CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (bsc#1273882).
• CVE-2026-64011: nfc: llcp: Fix use-after-free in llcp_sock_release() (bsc#1273891).
• CVE-2026-64015: security/keys: fix missed RCU read section on lookup (bsc#1273762).
• CVE-2026-64029: ALSA: seq: Serialize UMP output teardown with event_input (bsc#1273766).
• CVE-2026-64048: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (bsc#1273484).
• CVE-2026-64098: drm/virtio: use uninterruptible resv lock for plane updates (bsc#1273488).
• CVE-2026-64109: af_unix: Peek the queue synchronized (bsc#1273748).
• CVE-2026-64114: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (bsc#1273742).
• CVE-2026-64115: vsock/vmci: fix UAF when peer resets connection during handshake (bsc#1273745).
• CVE-2026-64121: net: ifb: report ethtool stats over num_tx_queues…

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68376: sctp: patch over auth_hmacs copy overflow (bsc#1274836).
• CVE-2026-72083: target: fix double unmap data sg in core_scsi3_emulate_pro_register_and_move() (bsc#1275535).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
• CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
• CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).
• CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
• CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
• CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
• CVE-2026-74641: ALSA: usx2y: bound the hwdep mmap fault offset (bsc#1278310).
• CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
• CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
• CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
• CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
• CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
• CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).

The following non security issue was fixed:

• Disable BATMAN in supported.conf
• Disable CONFIG_BATMAN_ADV (jsc#PED-16892)
• Disable CONFIG_CAN (jsc#PED-17000)