CVE-2026-89972

In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs. The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix race between dump and ip_set_list resize

The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section.

A concurrent ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait for them and the old array can be freed while they still index into it, causing a use-after-free.

The dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex().

BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ... Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7] RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception(CVE-2026-64189)

In the Linux kernel, the following vulnerability has been resolved:

sctp: drop a chunk if its transport was removed

sctp_rcv() resolves the transport once per packet and leaves it in chunk->transport. The lookup reference, or the one sctp_add_backlog() takes if the socket is owned by userspace, keeps it around until the chunk has been processed.

An authenticated ASCONF DEL-IP can remove it in the meantime. sctp_assoc_rm_peer() takes the transport out of the association and calls sctp_transport_free(), which tags it dead and drops the reference the association held. There is a window on both paths: the packet can sit on the socket backlog, and on the direct path the lookup completes before bh_lock_sock().

The DATA chunk in that packet puts the removed transport back into asoc->peer.last_data_from. Once the packet is done that reference goes away and the transport is freed by RCU, so the next delayed SACK carries the pointer into the SACK chunk and sctp_outq_select_transport() reads the freed transport's state.

Drop the chunk in sctp_inq_push(), next to the existing rcvr->dead check. Both paths reach it with the association's socket lock held. The peer retransmits it.(CVE-2026-89478)

In the Linux kernel, the following vulnerability has been resolved:

sctp: stop processing a packet once its association is deleted

sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->transport without taking a reference.

A packet that matches no association is handed to the endpoint, so a peer can bundle COOKIE ECHO, SHUTDOWN and SHUTDOWN ACK in one packet. The COOKIE ECHO creates the association, the SHUTDOWN chunk caches it, and with the outqueue empty the SHUTDOWN ACK reaches sctp_sf_do_9_2_final(), so the association and its transports are freed.

The endpoint loop has no counterpart to the asoc->base.dead check in sctp_assoc_bh_rcv(). The next chunk writes to last_time_heard in the freed transport and is then passed to sctp_do_sm() with the freed association. The transport is freed through RCU, so this needs the packet to come off the socket backlog, where the loop runs in task context.

The endpoint loop cannot do the same check: it…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)

• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

• kernel: gfs2: add some missing log locking (CVE-2026-53049)

• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)

• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

• Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)

• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)

• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)

• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)

• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)

• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)

• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)

• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)

• kernel: gfs2: add some missing log locking (CVE-2026-53049)

• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)

• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)

• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)

• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)

• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)

• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)

• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)

• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)

• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)

• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)

• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)

• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)

• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)

• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)

• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)

• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)

• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)

• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)

• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)

• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• Rocky Linux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:Rocky Linux-252194)

• Rocky Linux8.10 - s390/topology: Use zero-based numbering (JIRA:Rocky Linux-252199)

• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:Rocky Linux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs. The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)
• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
• kernel: gfs2: add some missing log locking (CVE-2026-53049)
• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)
• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)
• AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)
• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in xc5000 tuner driver due to race condition (CVE-2025-39994)
• kernel: gfs2: Fix unlikely race in gdlm_put_lock (CVE-2025-40242)
• kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction (CVE-2023-54048)
• kernel: nvme-pci: fix mempool alloc size (CVE-2022-50756)
• kernel: Linux kernel: Denial of Service in QFQ scheduler via child qlen manipulation (CVE-2026-23105)
• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
• kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
• kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
• kernel: gfs2: add some missing log locking (CVE-2026-53049)
• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
• kernel: net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CVE-2026-53230)
• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)
• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
• kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
• kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744)
• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
• kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)

Bug Fix(es) and Enhancement(s):

• AlmaLinux8.10 - s390/vfio_ccw: Error path cleanups (JIRA:AlmaLinux-252194)
• AlmaLinux8.10 - s390/topology: Use zero-based numbering (JIRA:AlmaLinux-252199)
• [nfs rhel8.10] Disable async copy on nfsd side (JIRA:AlmaLinux-266661)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860)
• kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
• kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)
• kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972)
• kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270)
• kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)
• kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
• kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
• kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
• kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
• kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
• kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024)
• kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918)
• kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
• kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
• kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (CVE-2026-63994)
• kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078)
• kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132)
• kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)
• kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
• kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476)
• kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
• kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
• kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
• kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
• kernel: packet: use consistent hard_header_len in non-ring send paths ()
• kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582)
• kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
• kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
• kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
• kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
• kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
• kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
• kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
• kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
• kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)

Bug Fix(es) and Enhancement(s):

• wifi card breaks using FIPS (JIRA:AlmaLinux-257457)
• AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

nvme: add missing SRCU grace period in error path

nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wait for SRCU readers before freeing the namespace struct. Multipath code iterates the head->list under srcu_read_lock() in nvme_find_path() and nvme_mpath_revalidate_paths(), so a concurrent reader can still hold a reference to ns when kfree(ns) runs.

The normal removal path in nvme_ns_remove() correctly calls synchronize_srcu(&ns->head->srcu) after list_del_rcu() to wait for in-progress readers. Add the same grace period in the error path.

• CVE-2026-90205
  • ocfs2: validate orphan slot during inode read {CVE-2026-90205}
• CVE-2026-93054
  • uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
• CVE-2026-93103
  • RDMA/hfi1: Preserve unit 0 on allocation failure {CVE-2026-93103}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-89878
  • media: s2255: check firmware size before reading trailing marker {CVE-2026-89878}
• CVE-2026-90037
  • NFSD: Prevent client use-after-free during close_lru reaping {CVE-2026-90037}
• CVE-2026-90296
  • cpufreq: imx6q: fix devres accumulation across driver rebind {CVE-2026-90296}
• CVE-2026-90415
  • RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
• CVE-2026-90081
  • net/rds: use wq_has_sleeper() in rds_cong_map_updated() {CVE-2026-90081}
• CVE-2026-90420
  • nilfs2: fix infinite loop in nilfs_clean_segments() {CVE-2026-90420}
• CVE-2026-90116
  • ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• CVE-2026-90070
  • tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
• CVE-2026-89845
  • scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845}
• CVE-2026-89944
  • ASoC: hdac_hda: Fix hlink refcount leak on component registration failure {CVE-2026-89944}
• CVE-2026-90018
  • staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() {CVE-2026-90018}
• CVE-2026-89860
  • scsi: qla2xxx: Initialize NVMe abort_work once at submission {CVE-2026-89860}
• CVE-2026-90007
  • scsi: pm8001: Use rollback index when freeing MSI-X vectors {CVE-2026-90007}
• CVE-2026-90044
  • usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044}
• CVE-2026-68289
  • tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
• CVE-2026-90143
  • net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143}
• CVE-2026-90111
  • ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111}
• CVE-2026-90283
  • hugetlbfs: release subpool on fill_super failure {CVE-2026-90283}
• CVE-2026-92521
  • ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521}
• CVE-2026-93048
  • mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048}
• CVE-2026-93160
  • crypto: atmel-ecc - reject hardware ECDH without a public key {CVE-2026-93160}
• CVE-2026-93199
  • i3c: master: Do not treat master device as a duplicate target {CVE-2026-93199}
• CVE-2026-89953
  • mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89937
  • iio: chemical: sgp30: Handle IAQ thread creation failure {CVE-2026-89937}
• CVE-2026-89993
  • dmaengine: dw-edma: Initialize IRQ data before requesting IRQs {CVE-2026-89993}
• CVE-2026-89972
  • nvme: add missing SRCU grace period in error path {CVE-2026-89972}
• CVE-2026-89892
  • media: em28xx: defer audio-only extension registration {CVE-2026-89892}
• CVE-2026-90023
  • usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() {CVE-2026-90023}
• CVE-2026-90020
  • USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020}
• CVE-2026-90017
  • staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() {CVE-2026-90017}
• CVE-2026-90016
  • staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016}
• CVE-2026-90329
  • HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} *…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• CVE-2026-53091
  • xfrm: Don't clobber inner headers when already set {CVE-2026-53091}
  • net: account for encap headers in qdisc pkt len {CVE-2026-53091}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-93286
  • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286}
• CVE-2026-93280
  • greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280}
• CVE-2026-93213
  • of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213}
• CVE-2026-93802
  • wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802}
• CVE-2026-93206
  • PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• CVE-2026-97448
  • ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
• CVE-2026-97408
  • Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
• CVE-2026-93268
  • ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268}
• CVE-2026-93782
  • vhost-scsi: flush backend after device ioctls {CVE-2026-93782}
• CVE-2026-93783
  • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783}
• CVE-2026-97455
  • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
• CVE-2026-93807
  • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807}
• CVE-2026-93808
  • ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808}
• CVE-2026-89938
  • iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938}
• CVE-2026-89927
  • KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927}
• CVE-2026-89949
  • batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949}
• CVE-2026-89912
  • KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912}
• CVE-2026-89932
  • KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-89854
  • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854}
• CVE-2026-90015
  • xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
• CVE-2026-89979
  • ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2026-89861
  • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• CVE-2026-89859
  • scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859}
• CVE-2026-90036
  • NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036}
• CVE-2026-89987
  • mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987}
• CVE-2026-89799
  • bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799}
• CVE-2026-90032
  • media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89929
  • KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929}
• CVE-2026-89840
  • f2fs: validate MOVE_RANGE destination size {CVE-2026-89840}
• CVE-2026-89913
  • KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} *…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• net: Introduce skb tc depth field to track packet loops {CVE-2026-63983}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• ata: libata-core: Reject an invalid concurrent positioning ranges count {CVE-2026-72030}
• wifi: mac80211: validate extension-frame layout before RX {CVE-2026-68470}
• wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() {CVE-2026-68470}
• drm/amd/pm: fix pptable use-after-free {CVE-2026-74450}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: clear ce->tgthint in free_tgts() {CVE-2026-89636}
• smb: client: harden DFS cache against invalid target hints {CVE-2026-93210}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• HID: sony: clean up device list on probe failure {CVE-2026-90041}
• drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
• hwrng: core - fix rng list on registration error {CVE-2026-93163}
• RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104}
• fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() {CVE-2026-93100}
• bpf: Fix potential UAF when reading bpf link info {CVE-2026-90392}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171}
• netfilter: cttimeout: prevent UAF during module unload {CVE-2026-97609}
• thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367}
• ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312}
• scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887}
• scsi: target: Fix hexadecimal CHAP_I handling {CVE-2026-63886}
• scsi: target: iscsi: Validate CHAP_R length before base64 decode {CVE-2026-63886}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• nfsd: RCU-protect cl_cb_session to fix…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• sunrpc: defer rq_argp and rq_resp free until after RCU grace period {CVE-2026-89545}
• seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976}
• ipv6: seg6: clear IPv4 control block on IPIP decapsulation {CVE-2026-80840}
• i3c: master: svc: bound IBI payload to the requested max_payload_len {CVE-2026-80951}
• i3c: master: svc: Use readsb helper for reading MDB {CVE-2026-80951}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access {CVE-2026-98365}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• drm/virtio: use uninterruptible resv lock for plane updates {CVE-2026-64098}
• keys: Pin request_key_auth payload in instantiate paths {CVE-2026-63823}
• exfat: fix potential use-after-free in exfat_find_dir_entry() {CVE-2026-63808}
• ethtool: cmis: require exact CDB reply length {CVE-2026-63996}
• tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 {CVE-2026-63994}
• ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922}
• netpoll: fix a use-after-free on shutdown path {CVE-2026-64424}
• HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362}
• bpf: Validate BTF repeated field counts before expansion {CVE-2026-64354}
• USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}
• ALSA: seq: Serialize UMP output teardown with event_input {CVE-2026-64029}
• xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009}
• vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() {CVE-2026-63993}
• tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() {CVE-2026-63992}
• vsock/virtio: bind uarg before filling zerocopy skb {CVE-2026-63970}
• KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() {CVE-2026-64555}
• drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• crypto: af_alg - zero initialize memory allocated via sock_kmalloc {CVE-2025-71113}
• mailbox: mailbox-test: don't free the reused channel {CVE-2026-53294}
• drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
• af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• nfsd: release layout stid on setlease failure {CVE-2026-53399}
• fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
• blk-mq: pop cached request if it is usable {CVE-2026-64017}
• scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888}
• posix-cpu-timers: Prevent UAF caused by non-leader exec() race {CVE-2026-64560}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268}
• Bluetooth: btusb: fix use-after-free on marvell probe failure {CVE-2026-64470}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• sched/core: Make core-sched flips wait for in-flight selections {CVE-2026-89520}
• net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• drm/amd/pm: fix pptable use-after-free {CVE-2026-74450}
• tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404}
• NFSD: Prevent client use-after-free during delegation revoke…

• net: skbuff: propagate shared-frag marker in skb_zerocopy()
• net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480}
• net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581}
• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714}
• net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503}
• sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130}
• tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283}
• sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
• usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962}
• ice: fix double-free of tx_buf skb {CVE-2026-53009}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078}
• crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362}
• HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
• KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222}
• scsi: qla2xxx: Skip vport under deletion in report ID acquisition {CVE-2026-97531}
• dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343}
• tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282}
• libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
• libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956}
• sctp: prevent peer transport count overflow {CVE-2026-74469}
• sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• nvme: add missing SRCU grace period in error path {CVE-2026-89972}
• nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
• drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
• drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}
• usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408}
• ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
• wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069}
• Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
• scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011}
• scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149}
• pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• fs/mbcache: cancel shrink work before destroying the…

• net: bridge: fix vlan tunnel dst refcnt when egressing {CVE-2021-47222}
• net: bridge: fix vlan tunnel dst null pointer dereference {CVE-2021-47223}
• writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378}
• writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
• writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
• fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount {CVE-2026-64378}
• libceph: validate banner payload length {CVE-2026-90067}
• drm/virtio: release the GEM object on virtio_gpu_vram_create() errors {CVE-2026-98606}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs {CVE-2026-74390}
• nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685}
• vdpa_sim_blk: reject out-of-range sector starts {CVE-2026-97991}
• Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
• HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
• nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482}
• nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386}
• bpf: mark a NULL call argument precise {CVE-2026-98019}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get {CVE-2026-72262}
• ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes() {CVE-2026-72262}
• Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• fs/resctrl: Fix UAF from worker threads when domains are removed {CVE-2026-93099}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
• openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• sctp: diag: reject stale associations in dump_one path {CVE-2026-52917}
• sctp: Hold sock lock while iterating over address list {CVE-2026-52917}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• nfsd: gate nfs3…

Upstream kernel 6.18.55 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.18.55 fixes vulnerabilities. For information about the vulnerabilities see the links.

These are all security issues fixed in the kernel-devel-7.2.7-1.1 package on the GA media of openSUSE Tumbleweed.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

It was discovered that the io_uring subsystem in the Linux kernel did not properly handle canceled task work when processing certain wait operations, leading to the operation being performed in the wrong task context. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2026-81010)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Intel NPU Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Ublk userspace block driver;
• Bluetooth drivers;
• Character device driver;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• ARM SCMI message protocol;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• Texas Instruments network drivers;
• MediaTek network drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• NVMEM (Non Volatile Memory) drivers;
• PCI subsystem;
• Chrome hardware platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• NVIDIA Tegra SoC drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• USB Device Class drivers;
• Faraday FOTG210 USB2 dual-role controller driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Siemens ID Mouse USB driver;
• IOWarrior USB driver;
• LD Didactic USB driver;
• LEGO USB Tower driver;
• USB Serial drivers;
• USB Type-C support driver;
• USB Type-C Port Controller Manager driver;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• VFIO drivers;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• AFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• File systems infrastructure;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• Network file system (NFS) server daemon;
• NILFS2 file system;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• SMB network file system;
• UBI file system;
• Drivers core;
• Tracing infrastructure;
• KProbes tracing;
• Networking core;
• Netfilter;
• Sun RPC protocol;
• IPv6 networking;
• Bluetooth subsystem;
• IPv4 networking;
• IP tunnels definitions;
• SCTP protocol;
• User-space API (UAPI);
• IPC subsystem;
• Audit subsystem;
• BPF subsystem;
• DMA mapping infrastructure;
• Kernel futex primitives;
• Scheduler infrastructure;
• Signal handling mechanism;
• Memory management;
• 6LoWPAN network protocol;
• IEEE 802 network protocols;
• B.A.T.M.A.N. meshing protocol;
• Ethernet bridge;
• CAN network layer;
• Ceph Core library;
• Devlink API;
• HSR network protocol;
• IEEE802154.4 network protocol;
• IUCV driver;
• MAC80211 subsystem;
• Management Component Transport Protocol (MCTP);
• MultiProtocol Label Switching driver;
• Multipath TCP;
• NetLabel subsystem; …