CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays. A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain. Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:ALSA: caiaq: Use snd_card_free_when_closed() at disconnectionThe USB disconnect callback is supposed to be short and not too-longwaiting. OTOH, the current code uses snd_card_free() atdisconnection, but this waits for the close of all used fds, hence itcan take long. It eventually blocks the upper layer USB ioctls, whichmay trigger a soft lockup.An easy workaround is to replace snd_card_free() withsnd_card_free_when_closed(). This variant returns immediately whilethe release of resources is done asynchronously by the card devicerelease at the last close.This patch also splits the code to the disconnect and the free phases;the former is called immediately at the USB disconnect callback whilethe latter is called from the card destructor.(CVE-2024-56531)

In the Linux kernel, the following vulnerability has been resolved:xsk: fix OOB map writes when deleting elementsJordy says: In the xsk_map_delete_elem function an unsigned integer(map->max_entries) is compared with a user-controlled signed integer(k). Due to implicit type conversion, a large unsigned value formap->max_entries can bypass the intended bounds check: if (k >= map->max_entries) return -EINVAL;This allows k to hold a negative value (between -2147483648 and -2),which is then used as an array index in m->xsk_map[k], which resultsin an out-of-bounds access. spin_lock_bh(&m->lock); map_entry = &m->xsk_map[k]; // Out-of-bounds map_entry old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write if (old_xs) xsk_map_sock_delete(old_xs, map_entry); spin_unlock_bh(&m->lock);The xchg operation can then be used to cause an out-of-bounds write.Moreover, the invalid map_entry passed to xsk_map_sock_delete can leadto further memory corruption. It indeed results in following splat:[76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108[76612.904330] #PF: supervisor write access in kernel mode[76612.909639] #PF: error_code(0x0002) - not-present page[76612.914855] PGD 0 P4D 0[76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP[76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470[76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019[76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60[76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff <48> 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31[76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246[76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000[76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000[76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007[76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8[76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0[76613.005303] FS: 00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000[76613.013517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0[76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000[76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400[76613.041086] PKRU: 55555554[76613.043842] Call Trace:[76613.046331] <TASK>[76613.048468] ? __die+0x20/0x60[76613.051581] ? page_fault_oops+0x15a/0x450[76613.055747] ? search_extable+0x22/0x30[76613.059649] ? search_bpf_extables+0x5f/0x80[76613.063988] ? exc_page_fault+0xa9/0x140[76613.067975] ? asm_exc_page_fault+0x22/0x30[76613.072229] ? xsk_map_delete_elem+0x2d/0x60[76613.076573] ? xsk_map_delete_elem+0x23/0x60[76613.080914] …

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)

• kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)

• kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)

• kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)

• kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)

• kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)

• kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

• kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)

• kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)

• kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)

• kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)

• kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

• kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

• kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

• kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)

• kernel: signal: Prevent exec() race (CVE-2026-98256)

• kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

Bug Fix(es) and Enhancement(s):

• [10.2.z] kselftests: mm: hugepage-mremap: Bail out! mremap: Expected failure, but call succeeded (JIRA:Rocky Linux-181987)

• [IBM 10.3 FEAT] zcrypt driver overwrite function - kernel part [rhel-10.2.z] (JIRA:Rocky Linux-245336)

• Batch: z-stream xfrm - rhel-10.2.z (NST-Core-26W38) (JIRA:Rocky Linux-256678)

• RHIVOS - [backport] S32G Driver Enablement - USB (JIRA:Rocky Linux-257228)

• Fix pending kernel issues for L1VH GA - Kernel (JIRA:Rocky Linux-267038)

• Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [rhel-10.2.z] (JIRA:Rocky Linux-280590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)

• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

• kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

• kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

• kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

• kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

• kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

• kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

• kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

• kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

Bug Fix(es) and Enhancement(s):

• gfs2 filesystem withdrawal rework [Rocky Linux-8] (JIRA:Rocky Linux-129363)

• Batch: z-stream xfrm - rhel-8.10.z (NST-Core-26W38) (JIRA:Rocky Linux-256684)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)

• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

• kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

• kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

• kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)

• kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

• kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)

• kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

• kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()

• kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

Bug Fix(es) and Enhancement(s):

• gfs2 filesystem withdrawal rework [Rocky Linux-8] (JIRA:Rocky Linux-129363)

• Batch: z-stream xfrm - rhel-8.10.z (NST-Core-26W38) (JIRA:Rocky Linux-256684)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541)

• kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)

• kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452)

• kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451)

• kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)

• kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)

• kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)

• kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)

• kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)

• kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)

• kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)

• kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)

• kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)

• kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)

• kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)

• kernel: s390/boot: Avoid IPL parameter append past command line (CVE-2026-98403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays. A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain. Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
• kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
• kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917)
• kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801)
• kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971)
• kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962)
• kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)
• kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117)
• kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300)
• kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315)
• kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509)
• kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)
• kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)
• kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)
• kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
• kernel: signal: Prevent exec() race (CVE-2026-98256)
• kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)

Bug Fix(es) and Enhancement(s):

• [10.2.z] kselftests: mm: hugepage-mremap: Bail out! mremap: Expected failure, but call succeeded (JIRA:AlmaLinux-181987)
• [IBM 10.3 FEAT] zcrypt driver overwrite function - kernel part [almalinux-10.2.z] (JIRA:AlmaLinux-245336)
• Batch: z-stream xfrm - rhel-10.2.z (NST-Core-26W38) (JIRA:AlmaLinux-256678)
• RHIVOS - [backport] S32G Driver Enablement - USB (JIRA:AlmaLinux-257228)
• Fix pending kernel issues for L1VH GA - Kernel (JIRA:AlmaLinux-267038)
• Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [almalinux-10.2.z] (JIRA:AlmaLinux-280590)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
• kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)
• kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)
• kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)
• kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
• kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
• kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)
• kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()
• kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

Bug Fix(es) and Enhancement(s):

• gfs2 filesystem withdrawal rework [AlmaLinux-8] (JIRA:AlmaLinux-129363)
• Batch: z-stream xfrm - almalinux-8.10.z (NST-Core-26W38) (JIRA:AlmaLinux-256684)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935)
• kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)
• kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)
• kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)
• kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)
• kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
• kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
• kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)
• kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation ()
• kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

Bug Fix(es) and Enhancement(s):

• gfs2 filesystem withdrawal rework [AlmaLinux-8] (JIRA:AlmaLinux-129363)
• Batch: z-stream xfrm - almalinux-8.10.z (NST-Core-26W38) (JIRA:AlmaLinux-256684)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541)
• kernel: sctp: avoid auth_enable sysctl UAF during netns teardown (CVE-2026-68162)
• kernel: s390/zcrypt: Validate length for CCA AES cipher key requests (CVE-2026-68452)
• kernel: s390/zcrypt: Validate length for CCA ECC private key requests (CVE-2026-68451)
• kernel: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (CVE-2026-72222)
• kernel: sunrpc: wait for in-flight TLS handshake callback when cancel loses race (CVE-2026-72221)
• kernel: fs/resctrl: Fix use-after-free during unmount (CVE-2026-72080)
• kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588)
• kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586)
• kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752)
• kernel: s390/vfio_ccw: Cancel existing workqueues (CVE-2026-80553)
• kernel: powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (CVE-2026-80571)
• kernel: s390/qeth: validate user buffer length in SNMP and ARP query ioctls (CVE-2026-80584)
• kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
• kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)
• kernel: s390/boot: Avoid IPL parameter append past command line (CVE-2026-98403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

sctp: validate cookie AUTH state before use

When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays.

A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain.

Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids.

• net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
• wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
• drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
• sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
• cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
• wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
• wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
• wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
• net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
• net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
• net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
• net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
• net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
• netfilter: ebtables: zero chainstack array {CVE-2026-64413}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
• can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
• can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
• can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
• scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
• can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
• can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
• can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
• ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
• perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
• ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

• net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
• wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
• drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
• sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
• cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
• wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
• wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
• wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
• net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
• net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
• net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
• net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
• net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
• netfilter: ebtables: zero chainstack array {CVE-2026-64413}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
• can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
• can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
• can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
• scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
• can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
• can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
• can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
• ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
• perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
• ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

• net: openvswitch: fix skb leak on flow key update failure during ct {CVE-2026-74464}
• can: peak_usb: peak_usb_start(): fix double free of transfer buffer on URB submit error {CVE-2026-74456}
• wifi: mwifiex: fix permanently busy scans after multiple roam iterations {CVE-2026-68469}
• drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430}
• sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
• cdrom: fix stack out-of-bounds read in CDROMVOLCTRL {CVE-2026-68184}
• wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read {CVE-2026-68351}
• wifi: carl9170: fix buffer overflow in rx_stream failover path {CVE-2026-68349}
• wifi: carl9170: fix OOB read from off-by-two in TX status handler {CVE-2026-68350}
• net: sit: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72061}
• net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055}
• net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72054}
• net: ipip: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72053}
• net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72051}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411}
• netfilter: ebtables: zero chainstack array {CVE-2026-64413}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• can: bcm: track a single source interface for ANYDEV timeout/throttle ops {CVE-2026-72115}
• can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() {CVE-2026-72117}
• can: bcm: fix stale rx/tx ops after device removal {CVE-2026-72116}
• can: bcm: add missing device refcount for CAN filter removal {CVE-2026-72113}
• scsi: libiscsi: Move ehwait initialization to iscsi_session_setup() {CVE-2021-47328}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix CAN frame rx/tx statistics {CVE-2026-72118}
• can: bcm: add locking when updating filter and timer values {CVE-2026-72121}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() {CVE-2026-72308}
• can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure {CVE-2026-72122}
• can: bcm: fix warning in bcm_connect/proc_register {CVE-2026-72113}
• ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
• perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
• ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} -…

• drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251}
• amd/amdkfd: sync all devices to wait all processes being evicted {CVE-2024-36949}
• Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted {CVE-2024-36909}
• Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl {CVE-2024-36912}
• xfs: save ailp before dropping the AIL lock in push callbacks {CVE-2026-31454}
• net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak {CVE-2026-43041}
• netfilter: nf_conntrack: destroy stale expectfn expectations on unregister {CVE-2026-53349}
• cifs: avoid NULL pointer dereference in dbg call {CVE-2025-37844}
• fs/notify: call exportfs_encode_fid with s_umount {CVE-2025-40237}
• cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258}
• pstore/ram: fix buffer overflow in persistent_ram_save_old() {CVE-2026-46253}
• Bluetooth: ISO: fix iso_conn related locking and validity issues {CVE-2023-54164}
• netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873}
• ext4: always drain queued discard work in ext4_mb_release() {CVE-2026-43065}
• ipvs: Defer ip_vs_ftp unregister during netns cleanup {CVE-2025-40018}
• Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
• sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto {CVE-2025-40281}
• fscache: Use wait_on_bit() to wait for the freeing of relinquished volume {CVE-2023-52982}
• libceph: prevent potential out-of-bounds reads in process_message_header() {CVE-2026-43406}
• netfilter: nf_tables: reject immediate NF_QUEUE verdict {CVE-2026-43024}
• ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() {CVE-2025-68261}
• bpf, sockmap: Fix af_unix iter deadlock {CVE-2026-53035}
• sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
• netfilter: xt_CT: drop pending enqueued packets on template removal {CVE-2026-23391}
• netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457}
• libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407}
• af_unix: read UNIX_DIAG_VFS data under unix_state_lock {CVE-2026-31673}
• jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted {CVE-2025-68337}
• Bluetooth: Fix NULL pointer deference on eir_get_service_data {CVE-2025-38304}
• net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption {CVE-2026-31533}
• fsnotify: do not generate ACCESS/MODIFY events on child for special files {CVE-2025-68788}
• isofs: validate Rock Ridge CE continuation extent against volume size {CVE-2026-46303}
• net: strparser: fix skb_head leak in strp_abort_strp() {CVE-2026-46102}
• sctp: fix uninit-value in __sctp_rcv_asconf_lookup() {CVE-2026-53225}
• xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
• xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
• bpf: tcp: fix double sock release on batch realloc {CVE-2026-64575}
• bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714}
• bpf: tcp: Avoid socket skips and repeats during iteration {CVE-2026-74714}
• bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items {CVE-2026-74714}
• bpf: tcp: Get rid of st_bucket_done {CVE-2026-74714}
• bpf: tcp: Make sure iter->batch always contains a full bucket snapshot {CVE-2026-64575}
• bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch {CVE-2026-74714}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689}
• net: add copy_safe_from_sockptr() helper {CVE-2026-74689}
• xfs: close crash window in attr dabtree…

• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2025-39827
  • net: rose: include node references in rose_neigh refcount {CVE-2025-39827}
• CVE-2026-93140
  • udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
• CVE-2026-90112
  • net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
• CVE-2026-90237
  • netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237}
• CVE-2026-93051
  • misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051}
• CVE-2026-90379
  • wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90383
  • misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-93047
  • drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047}
• CVE-2026-93192
  • drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192}
• CVE-2026-93050
  • ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050}
• CVE-2026-90311
  • thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311}
• CVE-2026-93191
  • smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191}
• CVE-2026-93042
  • dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042}
• CVE-2026-93056
  • usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
• CVE-2026-93203
  • batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203}
• CVE-2026-93204
  • batman-adv: dat: atomically update mac addresses {CVE-2026-93204}
• CVE-2026-90000
  • HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-93202
  • i3c: master: Fix recursive locking during device registration {CVE-2026-93202}
• CVE-2026-90347
  • arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347}
• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-92500
  • ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}
• CVE-2026-93196
  • nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
• CVE-2026-90207
  • ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-90110
  • inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110}
• CVE-2026-90293
  • IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
• CVE-2026-89838
  • f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
• CVE-2026-93177
  • drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177}
• CVE-2026-89823
  • drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
• CVE-2026-90041
  • HID: sony: clean up device list on probe failure {CVE-2026-90041}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-93095 -…

• drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
• Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
• ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
• ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
• libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
• SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
• SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
• openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}
• nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
• RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
• nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
• ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
• tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
• sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
• bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• mpls: reload header after pskb_may_pull() {CVE-2026-89555}
• net: tun: bound receive headroom {CVE-2026-81000}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
• firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• firewire: net: remove unused variable 'guid' {CVE-2023-53432}
• gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760}
• gfs2: fix kernel…

• drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818}
• drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199}
• drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199}
• drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230}
• drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230}
• openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165}
• openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678}
• ALSA: usb: Fix UAF at delayed release of MIDI2 EPs {CVE-2026-74642}
• ALSA: usb-audio: fix use-after-free in ump_to_endpoint() {CVE-2026-74501}
• NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
• NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
• exec: do_close_on_exec() before taking exec_update_lock {CVE-2026-64371}
• proc: Fix broken error paths for namespace links {CVE-2026-64371}
• proc: protect ptrace_may_access() with exec_update_lock (part 1) {CVE-2026-64371}
• ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes {CVE-2026-74503}
• ALSA: timer: Forcibly close timer instances at closing {CVE-2026-53193}
• usb: typec: ucsi: Fix race condition and ordering in port unregistration {CVE-2026-74441}
• arp: do not assume dev_hard_header() does not change skb->head {CVE-2026-22988}
• netfilter: nft_ct: fix use-after-free in timeout object destroy {CVE-2026-31665}
• md/raid10: fix writes_pending and barrier reference leaks on discard failures {CVE-2026-72438}
• md/raid10: fix deadlock with check operation and nowait requests {CVE-2026-46050}
• mm: introduce and use {pgd,p4d}_populate_kernel() {CVE-2025-39844}
• vsock/virtio: fix zerocopy completion for multi-skb sends {CVE-2026-53365}
• vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting {CVE-2026-52994}
• mm: do file ownership checks with the proper mount idmap {CVE-2026-64294}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths {CVE-2026-45870}
• Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig {CVE-2026-53208}
• slip: bound decode() reads against the compressed packet length {CVE-2026-45843}
• net: tls: fix strparser anchor skb leak on offload RX setup failure {CVE-2026-52974}
• netfilter: nf_tables: unconditionally bump set->nelems before insertion {CVE-2026-23272}
• rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131}
• netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() {CVE-2026-23458}
• mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr {CVE-2025-21938}
• bpf: Fix NULL deref in map_kptr_match_type for scalar regs {CVE-2026-53032}
• bpf: Explicitly check accesses to bpf_sock_addr {CVE-2025-40078}
• nexthop: Forbid FDB status change while nexthop is in a group {CVE-2025-39980}
• bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN {CVE-2026-31525}
• x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() {CVE-2025-21913}
• ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() {CVE-2024-57994}
• drm/i915/vrr: require valid min/max vfreq for VRR {CVE-2026-68254}
• libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954}
• gfs2: prevent NULL pointer dereference during unmount {CVE-2026-53048}
• smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path {CVE-2026-31708}
• ext4: reject mount if bigalloc with s_first_data_block != 0 {CVE-2026-31447}
• NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324}
• netfilter: x_tables: guard option walkers against 1-byte tail reads {CVE-2026-43452}
• smb: client: Fix refcount leak for cifs_sb_tlink {CVE-2025-40103}
• smb: client: harden POSIX SID length parsing {CVE-2026-64380}
• crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
• bpf: Allow LPM map access from sleepable…

• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
• RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
• nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
• enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
• smb: client: reject overlapping data areas in SMB2 responses {CVE-2026-64257}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
• crypto: qat - protect interrupt mask CSRs with a spinlock {CVE-2026-64438}
• crypto: qat - remove intermediate tasklet for vf2pf {CVE-2026-64438}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
• sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
• mpls: reload header after pskb_may_pull() {CVE-2026-89555}
• net: tun: bound receive headroom {CVE-2026-81000}
• bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• wifi: ath9k: hif_usb: don't dereference hif_dev after…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2024-36894
  • usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
• CVE-2026-97447
  • ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
• CVE-2026-93822
  • PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
• CVE-2026-93826
  • HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• CVE-2026-97954
  • net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
• CVE-2026-97949
  • configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• CVE-2026-97931
  • ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• CVE-2026-97940
  • ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• CVE-2026-97539
  • usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• CVE-2026-74510
  • Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• CVE-2026-72084
  • scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-90321
  • ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-74637
  • perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• CVE-2026-74752
  • sctp: validate cookie AUTH state before use {CVE-2026-74752}
• CVE-2026-74387
  • ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• CVE-2026-80536
  • xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• CVE-2026-89659
  • NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• CVE-2026-80576
  • drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• CVE-2026-90223
  • nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
• CVE-2026-80994
  • net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• CVE-2026-72398
  • sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• CVE-2026-74583
  • net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• CVE-2026-72322
  • ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• CVE-2026-93095
  • hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
• CVE-2026-72472
  • nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-90421
  • PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• CVE-2026-64583
  • usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
• CVE-2026-68329
  • iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
• CVE-2026-89448
  • iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• CVE-2026-64001
  • ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
• CVE-2026-64305
  • crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• CVE-2026-64348
  • usb: free iso schedules on failed submit {CVE-2026-64348}
• CVE-2026-64422
  • net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• CVE-2026-90180
  • block:…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}
• tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
• Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
• drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}
• RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
• mm/khugepaged: fix ->anon_vma race {CVE-2023-52935}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
• md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}
• bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
• net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
• drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
• nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
• tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
• crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
• nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}
• isdn: cpai: check ctr->cnr…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
• tracing: Set the trace clock before registering the histogram trigger {CVE-2026-97935}
• tracing: Fix use-after-free with same-name named triggers {CVE-2026-89746}
• svcrdma: Reject inline replies that overflow the pull-up buffer {CVE-2026-89530}
• RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path {CVE-2026-74377}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• ceph: fix UAF in check_new_map() on session freed during unlock {CVE-2026-89654}
• dm array: validate array block headers on read {CVE-2026-89574}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• wifi: ath9k_htc: don't store usb_device_id {CVE-2026-97541}
• fbdev: fix use-after-free in store_modes() {CVE-2026-63826}
• fbcon: Set fb_display[i]->mode to NULL when the mode is released {CVE-2025-40323}
• Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() {CVE-2026-45835}
• tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543}

• s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block {CVE-2026-98399}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• hwrng: geode - Fix PCI device refcount leak {CVE-2022-50659}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() {CVE-2026-80829}
• ubi: Fix use-after-free when volume resizing failed {CVE-2023-53800}
• btrfs: inode: Verify inode mode to avoid NULL pointer dereference {CVE-2019-19816}
• sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• scsi: libiscsi_tcp: Check the data direction of a Data-In PDU {CVE-2026-98479}
• Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
• net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489}
• net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488}
• Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough {CVE-2026-98602}
• ipvs: filter some flags received in the backup server {CVE-2026-98794}
• sctp: hold asoc or transport before mod_timer() in timer handlers {CVE-2026-98586}
• Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461}
• Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
• net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}
• vt: skip screen update for DEC alignment test on backgroup consoles {CVE-2026-98838}
• USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
• net: usb: catc: bound the RX packet length in catc_rx_done() {CVE-2026-98612}
• sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
• media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284}
• fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191}
• wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163}
• wifi: b43: enforce bounds check on firmware key index in b43_rx() {CVE-2026-46122}
• sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
• scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846}
• ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
• nfsd: fix posix_acl leak on SETACL decode failure {CVE-2026-53397}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• sctp: validate cookie AUTH state before use {CVE-2026-74752}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• selinux: require every boolean value to be defined {CVE-2026-80913}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). -…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
• CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
• CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-40136: crypto: hisilicon/qm - request reserved interrupt for virtual function (bsc#1253340).
• CVE-2026-23199: procfs: avoid fetching build ID while holding VMA lock (bsc#1258335).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using (bsc#1264330).
• CVE-2026-43272: ring-buffer: Fix possible dereference of uninitialized pointer (bsc#1264607).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46272: coresight: tmc-etr: Fix race condition between sysfs and perf mode (bsc#1267672).
• CVE-2026-53377: drm/msm: always recover the gpu (bsc#1271901).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-63838: ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (bsc#1272388).
• CVE-2026-63881: drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (bsc#1272571).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64132: ipv6: ioam: refresh hdr pointer before ioam6_event() (bsc#1272347).
• CVE-2026-64154: drm/msm/adreno: Fix a reference leak in a6xx_gpu_init() (bsc#1271950).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64216: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (bsc#1272802).
• CVE-2026-64235: x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (bsc#1272803).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64377: cpufreq: qcom-cpufreq-hw: Fix possible double free (bsc#1273297).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64402: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (bsc#1273258).
• CVE-2026-64405: Bluetooth: separate CIS_LINK and BIS_LINK link types (bsc#1273512).
• CVE-2026-64414: netfilter: handle unreadable frags (bsc#1273275).
• CVE-2026-64418: mm: shrinker: fix shrinker_info teardown race with expansion (bsc#1273784).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982).
• CVE-2026-64457: virtio_pci: fix vq info pointer lookup via wrong index (bsc#1273491).
• CVE-2026-64473: vfio: Remove device debugfs before releasing devres (bsc#1273320).
• CVE-2026-64474: vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (bsc#1274316).
• CVE-2026-64475: vfio/pci: Release the…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). -…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
• CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
• CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c:…

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68376: sctp: patch over auth_hmacs copy overflow (bsc#1274836).
• CVE-2026-72083: target: fix double unmap data sg in core_scsi3_emulate_pro_register_and_move() (bsc#1275535).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
• CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
• CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).
• CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
• CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
• CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
• CVE-2026-74641: ALSA: usx2y: bound the hwdep mmap fault offset (bsc#1278310).
• CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
• CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
• CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
• CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
• CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
• CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).

The following non security issue was fixed:

• Disable BATMAN in supported.conf
• Disable CONFIG_BATMAN_ADV (jsc#PED-16892)
• Disable CONFIG_CAN (jsc#PED-17000)

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64373: cpufreq: Fix hotplug-suspend race during…

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
• CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
• CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
• CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
• CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
• CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
• CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
• CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
• CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
• CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
• CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
• CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
• CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
• CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
• CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
• CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
• CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
• CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
• CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
• CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).
• CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
• CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).
• CVE-2026-74267: net/sched: sch_codel: Do not call…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40022: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
• CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
• CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
• CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
• CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
• CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
• CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
• CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
• CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
• CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
• CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
• CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
• CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
• CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
• CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).
• CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
• CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
• CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
• CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
• CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
• CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
• CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
• CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
• CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
• CVE-2026-72449: drm/amdkfd: fix list_del…

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
• CVE-2024-56644: net/ipv6: release expired exception dst cached in socket (bsc#1216813 bsc#1235133).
• CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40022: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
• CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
• CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
• CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
• CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
• CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
• CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
• CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
• CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
• CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
• CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
• CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
• CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
• CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
• CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
• CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
• CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
• CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (bsc#1276519).
• CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
• CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
• CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
• CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
• CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
• CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
• CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
• CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
• CVE-2026-74480: net: bridge: stop fast-leave…

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
• CVE-2025-39964: kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2025-40022: kernel: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68155: libceph: Reject monmaps advertising zero monitors (bsc#1275304).
• CVE-2026-68158: libceph: Fix multiplication overflow in decode_new_up_state_weight() (bsc#1275307).
• CVE-2026-68159: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (bsc#1275470).
• CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
• CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
• CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
• CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
• CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
• CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
• CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
• CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
• CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
• CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
• CVE-2026-72083: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (bsc#1275535).
• CVE-2026-72084: scsi: target: core: Generate correct identifiers for PR OUT transport IDs (bsc#1275540).
• CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
• CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
• CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
• CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
• CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
• CVE-2026-72339: qede: fix off-by-one in BD ring consumption on build_skb failure (bsc#1276006).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
• CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
• CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
• CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
• CVE-2026-72449: drm/amdkfd:…

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
• CVE-2024-56644: net/ipv6: release expired exception dst cached in socket (bsc#1216813 bsc#1235133).
• CVE-2025-39964: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (bsc#1252682).
• CVE-2025-40022: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
• CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64319: nvmet-auth: fix return value check in auth send (bsc#1273339).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
• CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
• CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
• CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
• CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
• CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
• CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
• CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
• CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
• CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
• CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
• CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
• CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
• CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
• CVE-2026-72398: sctp: fix association labeling in the duplicate COOKIE-ECHO case (bsc#1276381).
• CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
• CVE-2026-74267: net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (bsc#1276519).
• CVE-2026-74283: tipc: require net admin for TIPCv2 netlink mutators (bsc#1276475).
• CVE-2026-74330: configfs: fix lockless traversals of ->s_children (bsc#1277129).
• CVE-2026-74398: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD (bsc#1277410).
• CVE-2026-74443: drm/vmwgfx: bound DMA command body size against suffix pointer (bsc#1278210).
• CVE-2026-74444: drm/vmwgfx: validate DRAW_PRIMITIVES header size before division (bsc#1278211).
• CVE-2026-74453: drm/vc4: Zero the tile state data array before each BIN job (bsc#1278178).
• CVE-2026-74469: sctp: prevent peer transport count overflow (bsc#1277792).
• CVE-2026-74473: vxlan: use pskb_network_may_pull() in route_shortcircuit() (bsc#1276340).
• CVE-2026-74479: net: pktgen: fix proc entry use-after-free (bsc#1276354).
• CVE-2026-74480: net: bridge: stop fast-leave after…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts (bsc#1265138).
• CVE-2026-45834: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (bsc#1266412).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-46312: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (bsc#1267990).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-53037: HID: usbhid: fix deadlock in hid_post_reset() (bsc#1269081).
• CVE-2026-53237: gpio: mvebu: fix NULL pointer dereference in suspend/resume (bsc#1269131).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (bsc#1271834).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1273953).
• CVE-2026-63897: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (bsc#1272642).
• CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check (bsc#1272499).
• CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers (bsc#1272517).
• CVE-2026-63903: USB: serial: belkin_sa: validate interrupt status length (bsc#1272522).
• CVE-2026-63904: usb: usbtmc: check URB actual_length for interrupt-IN notifications (bsc#1272523).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63942: parport: Fix race between port and client registration (bsc#1273023).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63957: USB: serial: safe_serial: fix memory corruption with small endpoint (bsc#1272472).
• CVE-2026-63961: usb: typec: altmodes/displayport: validate count before reading Status Update VDO (bsc#1272480).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (bsc#1273769).
• CVE-2026-64097: drm/amd/display: Validate GPIO pin LUT table size before iterating (bsc#1273480).
• CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length (bsc#1272211).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64320: nvmet: fix discover log page when offsets are used (bsc#1273420).
• CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect (bsc#1274011).
• CVE-2026-64348: usb: free iso schedules on failed submit (bsc#1274026).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).
• CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
• CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982). -…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64373: cpufreq: Fix hotplug-suspend race during…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• NVDIMM (Non-Volatile Memory Device) drivers;
• Handshake API;
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• OpenRISC architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Intel NPU Driver;
• Android drivers;
• Rados block device (RBD) driver;
• Bluetooth drivers;
• Hardware random number generator core;
• TPM device driver;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• FireWire subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Mouse) drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Multifunction device drivers;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Texas Instruments network drivers;
• NTB driver;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• Parport drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• i.MX PM domains;
• System reset/shutdown drivers;
• PTP clock framework;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• Realtek RTL8723BS SDIO drivers;
• VME bus staging drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• USB Dual Role (OTG-ready) Controller drivers;
• USB Serial drivers;
• USB Type-C Port Controller Manager driver;
• vDPA drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• Watchdog drivers;
• 9P distributed file system;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• exFAT file system;
• F2FS file system;
• FUSE (File system in Userspace);
• Journaling layer for block devices (JBD2);
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• SMB network file system;
• Tracing file system;
• UDF file system;
• XFS file system;
• Key management;
• BPF subsystem;
• Control group (cgroup);
• Glob pattern matching library;
• MAC80211 subsystem;
• Mellanox drivers;
• Networking core;
• Network sockets;
• IPv6 networking;
• Bluetooth subsystem;
• Wireless networking;
• IPv4 networking;
• Netfilter;
• Network traffic control;
• SCTP protocol;
• TCP network protocol;
• XFRM subsystem;
• RDMA verbs API;
• io_uring subsystem;
• IPC subsystem;
• Audit subsystem;
• Kernel CPU control infrastructure;
• Perf events;
• Kernel exit() syscall;
• Kernel fork() syscall;
• Scheduler infrastructure;
• Signal handling mechanism;
• Timer subsystem;
• Tracing infrastructure;
• Resizable hashtable library;
• Memory management;
• 6LoWPAN network protocol;
• Asynchronous Transfer Mode (ATM) subsystem;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• CAN network layer;
• Ceph Core library;
• Ethtool driver;
• HSR network protocol;
• IEEE802154.4 network protocol;
• IUCV driver;
• KCM (Kernel Connection Multiplexor) sockets driver;
• IEEE 802.15.4 subsystem;
• Multipath TCP;
• Open vSwitch;
• Packet sockets;
• Phonet protocol;
• Qualcomm IPC Router (QRTR);
• RDS protocol;
• RxRPC session sockets;
• SMC…