CVE-2026-74637

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is reset to themselves. When a sibling is detached, it is removed from the leader's sibling_list, but its group_leader pointer is left pointing at the old leader. That is harmless when the sibling is being closed and freed immediately, as in the DETACH_DEAD path. It is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the sibling is removed from the context, while its file descriptor can still keep it alive. A typical failing sequence is: - A group contains leader L and sibling S. - CPU hot-unplug detaches S with DETACH_GROUP, removing it from L->sibling_list but leaving S->group_leader == L. - L is later closed and freed. - A PERF_IOC_FLAG_GROUP ioctl on S follows S->group_leader and dereferences the freed leader. This was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT pc : perf_ioctl+0x34c/0xc68 x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908) Call trace: perf_ioctl+0x34c/0xc68 (P) __arm64_sys_ioctl+0xa0/0xf4 invoke_syscall+0x58/0xe4 el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x40/0xc0 el0t_64_sync_handler+0x68/0xdc el0t_64_sync+0x1c4/0x1c8 The fault happened in perf_ioctl(), where perf_event_for_each() follows the stale group_leader pointer and perf_event_for_each_child() then dereferences the freed leader's context. Fix the use-after-free by promoting the detached sibling to a singleton. Also fix __event_disable() cgroup accounting and event state change.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

seg6: separate dst_cache for input and output paths in seg6 lwtunnel

The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup.

Fix this by splitting the cache into cache_input and cache_output, so each path maintains its own cached dst independently.(CVE-2026-31668)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE

The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory.

ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned.

This leads to incorrect iova-to-va conversion in scenarios:

1. page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000

   Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix:

   • index = (0x182010 >> 12) - (0x181800 >> 12) = 1
   • page_offset = 0x182010 & 0xFFF = 0x10
   • xarray[1] stores system page base 0x170000
   • Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)

2. page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000

   Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix:

   • index = (0x190010 >> 16) - (0x18f800 >> 16) = 1
   • page_offset = 0x190010 & 0xFFFF = 0x10
   • xarray[1] stores system page for dma_addr 0x170000
   • Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)

Yi Zhang reported a kernel panic[1] years ago related to this defect.

Solution:

1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous)
2. Each rxe_mr_page stores both struct page* and offset within the system page
3. Handle MR page_size != PAGE_SIZE relationships:
   • page_size > PAGE_SIZE: Split MR pages into multiple system pages
   • page_size <= PAGE_SIZE: Store offset within system page
4. Add boundary checks and compatibility validation

This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access.

Tests on 4K and 64K PAGE_SIZE hosts:

• rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe
• blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd

[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/(CVE-2026-46325)

In the Linux kernel, compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents. compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the signal-returning task's register state on…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

seg6: separate dst_cache for input and output paths in seg6 lwtunnel

The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These two paths can perform the post-encap SID lookup in different routing contexts (e.g., ip rules matching on the ingress interface, or VRF table separation). Whichever path runs first populates the cache, and the other reuses it blindly, bypassing its own lookup.

Fix this by splitting the cache into cache_input and cache_output, so each path maintains its own cached dst independently.(CVE-2026-31668)

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE

The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, each representing PAGE_SIZE of memory.

ib_sg_to_page() has ensured that when i>=1 either a) SG[i-1].dma_end and SG[i].dma_addr are contiguous or b) SG[i-1].dma_end and SG[i].dma_addr are mr->page_size aligned.

This leads to incorrect iova-to-va conversion in scenarios:

1. page_size < PAGE_SIZE (e.g., MR: 4K, system: 64K): ibmr->iova = 0x181800 sg[0]: dma_addr=0x181800, len=0x800 sg[1]: dma_addr=0x173000, len=0x1000

   Access iova = 0x181800 + 0x810 = 0x182010 Expected VA: 0x173010 (second SG, offset 0x10) Before fix:

   • index = (0x182010 >> 12) - (0x181800 >> 12) = 1
   • page_offset = 0x182010 & 0xFFF = 0x10
   • xarray[1] stores system page base 0x170000
   • Resulting VA: 0x170000 + 0x10 = 0x170010 (wrong)

2. page_size > PAGE_SIZE (e.g., MR: 64K, system: 4K): ibmr->iova = 0x18f800 sg[0]: dma_addr=0x18f800, len=0x800 sg[1]: dma_addr=0x170000, len=0x1000

   Access iova = 0x18f800 + 0x810 = 0x190010 Expected VA: 0x170010 (second SG, offset 0x10) Before fix:

   • index = (0x190010 >> 16) - (0x18f800 >> 16) = 1
   • page_offset = 0x190010 & 0xFFFF = 0x10
   • xarray[1] stores system page for dma_addr 0x170000
   • Resulting VA: system page of 0x170000 + 0x10 = 0x170010 (wrong)

Yi Zhang reported a kernel panic[1] years ago related to this defect.

Solution:

1. Replace xarray with pre-allocated rxe_mr_page array for sequential indexing (all MR page indices are contiguous)
2. Each rxe_mr_page stores both struct page* and offset within the system page
3. Handle MR page_size != PAGE_SIZE relationships:
   • page_size > PAGE_SIZE: Split MR pages into multiple system pages
   • page_size <= PAGE_SIZE: Store offset within system page
4. Add boundary checks and compatibility validation

This ensures correct iova-to-va conversion regardless of MR page size and system PAGE_SIZE relationship, while improving performance through array-based sequential access.

Tests on 4K and 64K PAGE_SIZE hosts:

• rdma-core/pytests $ ./build/bin/run_tests.py --dev eth0_rxe
• blktest: $ TIMEOUT=30 QUICK_RUN=1 USE_RXE=1 NVMET_TRTYPES=rdma ./check nvme srp rnbd

[1] https://lore.kernel.org/all/CAHj4cs9XRqE25jyVw9rj9YugffLn5+f=1znaBEnu1usLOciD+g@mail.gmail.com/T/(CVE-2026-46325)

In the Linux kernel, compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents. compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the signal-returning task's register state on…

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is reset to themselves. When a sibling is detached, it is removed from the leader's sibling_list, but its group_leader pointer is left pointing at the old leader. That is harmless when the sibling is being closed and freed immediately, as in the DETACH_DEAD path. It is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the sibling is removed from the context, while its file descriptor can still keep it alive. A typical failing sequence is: - A group contains leader L and sibling S. - CPU hot-unplug detaches S with DETACH_GROUP, removing it from L->sibling_list but leaving S->group_leader == L. - L is later closed and freed. - A PERF_IOC_FLAG_GROUP ioctl on S follows S->group_leader and dereferences the freed leader. This was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT pc : perf_ioctl+0x34c/0xc68 x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908) Call trace: perf_ioctl+0x34c/0xc68 (P) __arm64_sys_ioctl+0xa0/0xf4 invoke_syscall+0x58/0xe4 el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x40/0xc0 el0t_64_sync_handler+0x68/0xdc el0t_64_sync+0x1c4/0x1c8 The fault happened in perf_ioctl(), where perf_event_for_each() follows the stale group_leader pointer and perf_event_for_each_child() then dereferences the freed leader's context. Fix the use-after-free by promoting the detached sibling to a singleton. Also fix __event_disable() cgroup accounting and event state change.

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix group leader use-after-free after sibling detach

perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is reset to themselves. When a sibling is detached, it is removed from the leader's sibling_list, but its group_leader pointer is left pointing at the old leader.

That is harmless when the sibling is being closed and freed immediately, as in the DETACH_DEAD path. It is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the sibling is removed from the context, while its file descriptor can still keep it alive.

A typical failing sequence is:

• A group contains leader L and sibling S.
• CPU hot-unplug detaches S with DETACH_GROUP, removing it from L->sibling_list but leaving S->group_leader == L.
• L is later closed and freed.
• A PERF_IOC_FLAG_GROUP ioctl on S follows S->group_leader and dereferences the freed leader.

This was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently:

Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT pc : perf_ioctl+0x34c/0xc68 x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908) Call trace: perf_ioctl+0x34c/0xc68 (P) __arm64_sys_ioctl+0xa0/0xf4 invoke_syscall+0x58/0xe4 el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x40/0xc0 el0t_64_sync_handler+0x68/0xdc el0t_64_sync+0x1c4/0x1c8

The fault happened in perf_ioctl(), where perf_event_for_each() follows the stale group_leader pointer and perf_event_for_each_child() then dereferences the freed leader's context.

Fix the use-after-free by promoting the detached sibling to a singleton. Also fix __event_disable() cgroup accounting and event state change.

• net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
• wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
• drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
• sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
• cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
• wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
• wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
• wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
• net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
• net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
• net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
• net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
• net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
• netfilter: ebtables: zero chainstack array {CVE-2026-64413}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
• can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
• can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
• can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
• scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
• can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
• can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
• can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
• ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
• perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
• ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

• net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
• wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
• drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
• sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
• cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
• wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
• wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
• wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
• net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
• net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
• net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
• net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
• net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
• netfilter: ebtables: zero chainstack array {CVE-2026-64413}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
• can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
• can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
• can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
• scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
• can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
• can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
• can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
• ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
• perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
• ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

• net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
• wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
• drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
• sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
• cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
• wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
• wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
• wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
• net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
• net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
• net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
• net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
• net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
• netfilter: ebtables: zero chainstack array {CVE-2026-64413}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
• can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
• can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
• can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
• scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
• can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
• can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
• can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
• ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
• perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
• ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2025-39827
  • net: rose: include node references in rose_neigh refcount {CVE-2025-39827}
• CVE-2026-93140
  • udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
• CVE-2026-90112
  • net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
• CVE-2026-90237
  • netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237}
• CVE-2026-93051
  • misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051}
• CVE-2026-90379
  • wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90383
  • misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-93047
  • drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047}
• CVE-2026-93192
  • drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192}
• CVE-2026-93050
  • ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050}
• CVE-2026-90311
  • thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311}
• CVE-2026-93191
  • smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191}
• CVE-2026-93042
  • dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042}
• CVE-2026-93056
  • usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
• CVE-2026-93203
  • batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203}
• CVE-2026-93204
  • batman-adv: dat: atomically update mac addresses {CVE-2026-93204}
• CVE-2026-90000
  • HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-93202
  • i3c: master: Fix recursive locking during device registration {CVE-2026-93202}
• CVE-2026-90347
  • arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347}
• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-92500
  • ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}
• CVE-2026-93196
  • nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
• CVE-2026-90207
  • ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-90110
  • inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110}
• CVE-2026-90293
  • IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
• CVE-2026-89838
  • f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
• CVE-2026-93177
  • drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177}
• CVE-2026-89823
  • drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
• CVE-2026-90041
  • HID: sony: clean up device list on probe failure {CVE-2026-90041}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-93095 -…

• md/raid1,raid10: strip REQ_NOWAIT from member bios {CVE-2025-22125}
• md/raid1: fix data lost for writemostly rdev {CVE-2025-22125}
• md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT {CVE-2025-22125}
• md/raid1,raid10: don't ignore IO flags {CVE-2025-22125}
• net/sched: netem: fix queue limit check to include reordered packets {CVE-2026-52984}
• netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() {CVE-2025-21703}
• net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
• drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818}
• drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199}
• drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199}
• drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230}
• drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230}
• vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE {CVE-2022-48862}
• vhost: handle error while adding split ranges to iotlb {CVE-2022-48862}
• vhost: allow batching hint without size {CVE-2022-48862}
• vhost: fix hung thread due to erroneous iotlb entries {CVE-2022-48862}
• md raid: fix hang when stopping arrays with metadata through dm-raid {CVE-2026-43309}
• dm raid: use proper md_ro_state enumerators {CVE-2026-43309}
• i40e: When removing VF MAC filters, only check PF-set MAC {CVE-2024-26830}
• i40e: Fix VF MAC filter removal {CVE-2024-26830}
• i40e: Do not allow untrusted VF to remove administratively set MAC {CVE-2024-26830}
• netlink: make sure we allow at least one dump skb {CVE-2025-38465}
• netlink: avoid infinite retry looping in netlink_unicast() {CVE-2025-38465}
• netlink: Fix rmem check in netlink_broadcast_deliver(). {CVE-2025-38465}
• netlink: Fix wraparounds of sk->sk_rmem_alloc. {CVE-2025-38465}
• ipv6: fix possible infinite loop in rt6_fill_node() {CVE-2024-56703}
• ipv6: prevent infinite loop in rt6_nlmsg_size() {CVE-2024-56703}
• ipv6: Fix soft lockups in fib6_select_path under high next hop churn {CVE-2024-56703}
• qede: fix out-of-bounds check for cqe->len_list[] {CVE-2025-40252}
• net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() {CVE-2025-40252}
• scsi: lpfc: apply the HBA_SETUP dev_loss check to SLI4 only {CVE-2024-49891}
• scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths {CVE-2024-49891}
• ext4: fix string copying in parse_apply_sb_mount_options() {CVE-2025-71123}
• ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() {CVE-2025-40198}
• openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-31678}
• openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678}
• blk-iolatency: Fix memory leak on add_disk() failures {CVE-2022-50550}
• drm/vkms: Fix use after free and double free on init error {CVE-2025-22097}
• iommu/amd: move wait_on_sem() out of spinlock {CVE-2026-43253}
• fbdev: bitblit: bound-check glyph index in bit_cursor() {CVE-2026-74635}
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page {CVE-2026-80726}
• wifi: nl80211: reject beacons with bad HE operation {CVE-2026-97517}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() {CVE-2026-98374}
• ALSA: usb-audio: Fix a DMA to stack memory bug {CVE-2024-53197}
• ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices {CVE-2024-53197}
• USB: core: Limit the length of unkillable synchronous timeouts {CVE-2026-43428}
• ext4: refresh inline data size before write operations {CVE-2025-68264}
• net, bpf: check master for NULL in xdp_master_redirect() {CVE-2026-64545}
• iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() {CVE-2026-31505}
• dm cache: fix…

• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
• ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}
• nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
• RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
• nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
• ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
• tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
• sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
• bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• mpls: reload header after pskb_may_pull() {CVE-2026-89555}
• net: tun: bound receive headroom {CVE-2026-81000}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• firewire: net: remove unused variable 'guid' {CVE-2023-53432}
• gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760}
• gfs2: fix kernel…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2024-36894
  • usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
• CVE-2026-97447
  • ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
• CVE-2026-93822
  • PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
• CVE-2026-93826
  • HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• CVE-2026-97954
  • net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
• CVE-2026-97949
  • configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• CVE-2026-97931
  • ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• CVE-2026-97940
  • ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• CVE-2026-97539
  • usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• CVE-2026-74510
  • Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• CVE-2026-72084
  • scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-90321
  • ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-74637
  • perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• CVE-2026-74752
  • sctp: validate cookie AUTH state before use {CVE-2026-74752}
• CVE-2026-74387
  • ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• CVE-2026-80536
  • xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• CVE-2026-89659
  • NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• CVE-2026-80576
  • drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• CVE-2026-90223
  • nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
• CVE-2026-80994
  • net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• CVE-2026-72398
  • sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• CVE-2026-74583
  • net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• CVE-2026-72322
  • ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• CVE-2026-93095
  • hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
• CVE-2026-72472
  • nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-90421
  • PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• CVE-2026-64583
  • usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
• CVE-2026-68329
  • iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
• CVE-2026-89448
  • iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• CVE-2026-64001
  • ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
• CVE-2026-64305
  • crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• CVE-2026-64348
  • usb: free iso schedules on failed submit {CVE-2026-64348}
• CVE-2026-64422
  • net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• CVE-2026-90180
  • block:…

• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492}
• ocfs2: validate dx_root extent list fields during block read {CVE-2026-89492}
• nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}
• packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582}
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header {CVE-2026-80731}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404}
• net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants {CVE-2026-72390}
• net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390}
• Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
• NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476}
• sctp: distinguish sequence zero from wildcard in reconf lookup {CVE-2026-89476}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• net: Introduce skb tc depth field to track packet loops {CVE-2026-63983}
• netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• scsi: xen: scsiback: Free unsubmitted command instead of double-putting it {CVE-2026-72085}
• ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
• IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget {CVE-2026-89674}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• nvmet-tcp: fix race between ICReq handling and queue teardown {CVE-2026-46135}
• ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090}
• ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984}
• bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• mt76: fix per-driver wcid range checks after wcid array size bump {CVE-2022-49328}
• af_unix: Fix UAF read of…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• sunrpc: defer rq_argp and rq_resp free until after RCU grace period {CVE-2026-89545}
• seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976}
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation {CVE-2026-80840}
• i3c: master: svc: bound IBI payload to the requested max_payload_len {CVE-2026-80951}
• i3c: master: svc: Use readsb helper for reading MDB {CVE-2026-80951}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access {CVE-2026-98365}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• drm/virtio: use uninterruptible resv lock for plane updates {CVE-2026-64098}
• keys: Pin request_key_auth payload in instantiate paths {CVE-2026-63823}
• exfat: fix potential use-after-free in exfat_find_dir_entry() {CVE-2026-63808}
• ethtool: cmis: require exact CDB reply length {CVE-2026-63996}
• tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 {CVE-2026-63994}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• netpoll: fix a use-after-free on shutdown path {CVE-2026-64424}
• HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362}
• bpf: Validate BTF repeated field counts before expansion {CVE-2026-64354}
• USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}
• ALSA: seq: Serialize UMP output teardown with event_input {CVE-2026-64029}
• xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
• vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() {CVE-2026-63993}
• tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() {CVE-2026-63992}
• vsock/virtio: bind uarg before filling zerocopy skb {CVE-2026-63970}
• KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() {CVE-2026-64555}
• drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• crypto: af_alg - zero initialize memory allocated via sock_kmalloc {CVE-2025-71113}
• mailbox: mailbox-test: don't free the reused channel {CVE-2026-53294}
• drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
• af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• nfsd: release layout stid on setlease failure {CVE-2026-53399}
• fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
• blk-mq: pop cached request if it is usable {CVE-2026-64017}
• scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888}
• posix-cpu-timers: Prevent UAF caused by non-leader exec() race {CVE-2026-64560}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268}
• Bluetooth: btusb: fix use-after-free on marvell probe failure {CVE-2026-64470}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sched/core: Make core-sched flips wait for in-flight selections {CVE-2026-89520}
• net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• drm/amd/pm: fix pptable use-after-free {CVE-2026-74450}
• tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404}
• NFSD: Prevent client use-after-free during delegation revoke…

Upstream kernel 6.18.55 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.18.55 fixes vulnerabilities. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). -…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
• CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
• CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). -…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
• CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
• CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c:…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64373: cpufreq: Fix hotplug-suspend race during…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64373: cpufreq: Fix hotplug-suspend race during…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• NVDIMM (Non-Volatile Memory Device) drivers;
• Handshake API;
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• OpenRISC architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Intel NPU Driver;
• Android drivers;
• Rados block device (RBD) driver;
• Bluetooth drivers;
• Hardware random number generator core;
• TPM device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• FireWire subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• Parport drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• i.MX PM domains;
• System reset/shutdown drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Watchdog drivers;
• 9P distributed file system;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• exFAT file system;
• F2FS file system;
• FUSE (File system in Userspace);
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• SMB network file system;
• Tracing file system;
• UDF file system;
• XFS file system;
• Key management;
• BPF subsystem;
• Control group (cgroup);
• Glob pattern matching library;
• MAC80211 subsystem;
• Mellanox drivers;
• Networking core;
• Network sockets;
• IPv6 networking;
• Bluetooth subsystem;
• Wireless networking;
• IPv4 networking;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• TCP network protocol;
• XFRM subsystem;
• RDMA verbs API;
• io_uring subsystem;
• IPC subsystem;
• Audit subsystem;
• Kernel CPU control infrastructure;
• Perf events;
• Kernel exit() syscall;
• Kernel fork() syscall;
• Scheduler infrastructure;
• Signal handling mechanism;
• Timer subsystem;
• Tracing infrastructure;
• Resizable hashtable library;
• Memory management;
• 6LoWPAN network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• CAN network layer;
• Ceph Core library;
• Ethtool driver;
• HSR network protocol;
• IEEE802154.4 network protocol;
• IUCV driver;
• KCM (Kernel Connection Multiplexor) sockets driver;
• IEEE 802.15.4 subsystem;
• Multipath TCP;
• Open vSwitch;
• Packet sockets;
• Phonet protocol;
• Qualcomm IPC Router (QRTR);
• RDS protocol;
• RxRPC session sockets;
• SMC…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system; …

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• SMB network file system;
• SquashFS file system;
• UBI file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• IPv4 networking;
• Internal shared memory driver;
• Networking core;
• Scheduler infrastructure;
• Sun RPC protocol;
• Virtio network driver;
• Amateur Radio drivers;
• IP tunnels definitions;
• Network…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• User-space API (UAPI);
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Speakup Console Speech Driver;
• ACPI drivers;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Bluetooth drivers;
• Cdrom driver;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DAX dirext access to differentiated memory framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• Intel Trace Hub HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Generic PM domains;
• System reset/shutdown drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• Reset controller framework;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Media Oriented Systems Transport (MOST) driver;
• NVIDIA Tegra embedded controller (NVEC)…