CVE-2026-90088

• CVE-2026-99999
  • ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• CVE-2025-39945
  • cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
• CVE-2022-50315
  • ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• CVE-2025-38459
  • atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
• CVE-2025-38323
  • net: atm: add lec_mutex {CVE-2025-38323}
• CVE-2026-97540
  • net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• CVE-2026-93803
  • wifi: libipw: fix key index receive bound checks {CVE-2026-93803}
• CVE-2026-98077
  • netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
• CVE-2026-97608
  • netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• CVE-2026-97564
  • smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• CVE-2023-54213
  • USB: sisusbvga: Add endpoint checks {CVE-2023-54213}
• CVE-2026-80757
  • selinux: reject a class permission count below its inherited common {CVE-2026-80757}
• CVE-2026-89865
  • scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers {CVE-2026-89865}
• CVE-2026-89843
  • scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak {CVE-2026-89843}
• CVE-2026-80782
  • HID: magicmouse: do not keep a stale msc->input if no input is claimed {CVE-2026-80782}
• CVE-2026-90056
  • net: fec: only stop PTP if it was initialized {CVE-2026-90056}
• CVE-2026-80812
  • ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
• CVE-2022-50776
  • clk: st: Fix memory leak in st_of_quadfs_setup() {CVE-2022-50776}
• CVE-2026-80798
  • nfc: llcp: reject PDUs shorter than the LLCP header {CVE-2026-80798}
• CVE-2026-93061
  • gpu: host1x: Avoid stack over-read in debug output helpers {CVE-2026-93061}
• CVE-2026-90070
  • tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
• CVE-2026-90345
  • wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345}
• CVE-2026-80794
  • nfc: nci: fix uninit-value in the RF discover/activated NTF handlers {CVE-2026-80794}
• CVE-2026-80793
  • ipv4: reject undersized MTUs in ip_do_fragment() {CVE-2026-80793}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-63933
  • iio: gyro: adis16260: fix division by zero in write_raw {CVE-2026-63933}
• CVE-2026-80742
  • af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742}
• CVE-2026-90104
  • NFSv4.1: zero referring call lists before decoding {CVE-2026-90104}
• CVE-2026-90335
  • tty: skip cdev_del() when no cdev is registered {CVE-2026-90335}
• CVE-2026-90336
  • serial: core: clear freed pointers on uart_register_driver() failure {CVE-2026-90336}
• CVE-2026-89852
  • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852}
• CVE-2024-50076
  • vt: prevent kernel-infoleak in con_font_get() {CVE-2024-50076}
• CVE-2022-50641
  • HSI: omap_ssi: Fix refcount leak in ssi_probe {CVE-2022-50641}
• CVE-2026-80797
  • nfc: pn533: purge fragmented skbs during cleanup {CVE-2026-80797}
• CVE-2026-89982
  • i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982}
• CVE-2026-80733
  • net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733}
• CVE-2026-90068
  • ASoC: dapm: Fix off-by-one check on the second enum channel {CVE-2026-90068}
• CVE-2026-90055
  • usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055}
• CVE-2026-93141
  • usb: gadget: r8a66597: avoid double free of ep0_req in probe error path {CVE-2026-93141}
• CVE-2026-90088 -…

• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-92522
  • ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522}
• CVE-2026-90337
  • serial: core: do fallible allocations before the console can be registered {CVE-2026-90337}
• CVE-2026-90245
  • fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245}
• CVE-2026-90106
  • net: bridge: arp/nd proxy: fix reading neigh ha {CVE-2026-90106}
• CVE-2026-90150
  • pnfs/blocklayout: Fix device leaks on parse failure {CVE-2026-90150}
• CVE-2026-90222
  • nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222}
• CVE-2026-90235
  • sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
• CVE-2026-92499
  • ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
• CVE-2026-90259
  • btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() {CVE-2026-90259}
• CVE-2026-90418
  • nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch {CVE-2026-90418}
• CVE-2026-93053
  • speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053}
• CVE-2026-90189
  • null_blk: register configfs subsystem after creating default devices {CVE-2026-90189}
• CVE-2026-90194
  • ACPI: scan: fix bus ID cleanup on device_add() failures {CVE-2026-90194}
• CVE-2026-93037
  • RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037}
• CVE-2026-90225
  • nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225}
• CVE-2026-90138
  • vsock: don't check the listener's sk_err in vsock_accept() {CVE-2026-90138}
• CVE-2026-90141
  • ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141}
• CVE-2026-90286
  • drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286}
• CVE-2026-90058
  • net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058}
• CVE-2026-93188
  • HID: roccat: bound device-supplied profile index {CVE-2026-93188}
• CVE-2026-90053
  • net/sched: sch_htb: limit htb_classify inner-class filter hops {CVE-2026-90053}
• CVE-2026-90416
  • RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416}
• CVE-2026-90419
  • nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419}
• CVE-2026-90226
  • nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226}
• CVE-2026-90403
  • wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403}
• CVE-2026-90415
  • RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
• CVE-2026-53176
  • IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
• CVE-2026-90055
  • usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055}
• CVE-2026-90088
  • Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088}
• CVE-2026-90318
  • fat: release buffer head after rebuilding parent {CVE-2026-90318}
• CVE-2026-90073
  • net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073}
• CVE-2026-90216
  • ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216}
• CVE-2026-90070
  • tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
• CVE-2026-93120
  • usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120}
• CVE-2026-90143
  • net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143}
• CVE-2026-90104 -…

• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-92522
  • ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522}
• CVE-2026-90337
  • serial: core: do fallible allocations before the console can be registered {CVE-2026-90337}
• CVE-2026-90245
  • fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245}
• CVE-2026-90106
  • net: bridge: arp/nd proxy: fix reading neigh ha {CVE-2026-90106}
• CVE-2026-90150
  • pnfs/blocklayout: Fix device leaks on parse failure {CVE-2026-90150}
• CVE-2026-90222
  • nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222}
• CVE-2026-90235
  • sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
• CVE-2026-92499
  • ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
• CVE-2026-90259
  • btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() {CVE-2026-90259}
• CVE-2026-90418
  • nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch {CVE-2026-90418}
• CVE-2026-93053
  • speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053}
• CVE-2026-90189
  • null_blk: register configfs subsystem after creating default devices {CVE-2026-90189}
• CVE-2026-90194
  • ACPI: scan: fix bus ID cleanup on device_add() failures {CVE-2026-90194}
• CVE-2026-93037
  • RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037}
• CVE-2026-90225
  • nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225}
• CVE-2026-90138
  • vsock: don't check the listener's sk_err in vsock_accept() {CVE-2026-90138}
• CVE-2026-90141
  • ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141}
• CVE-2026-90286
  • drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286}
• CVE-2026-90058
  • net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058}
• CVE-2026-93188
  • HID: roccat: bound device-supplied profile index {CVE-2026-93188}
• CVE-2026-90053
  • net/sched: sch_htb: limit htb_classify inner-class filter hops {CVE-2026-90053}
• CVE-2026-90416
  • RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416}
• CVE-2026-90419
  • nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419}
• CVE-2026-90226
  • nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226}
• CVE-2026-90403
  • wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403}
• CVE-2026-90415
  • RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
• CVE-2026-53176
  • IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
• CVE-2026-90055
  • usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055}
• CVE-2026-90088
  • Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088}
• CVE-2026-90318
  • fat: release buffer head after rebuilding parent {CVE-2026-90318}
• CVE-2026-90073
  • net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073}
• CVE-2026-90216
  • ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216}
• CVE-2026-90070
  • tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
• CVE-2026-93120
  • usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120}
• CVE-2026-90143
  • net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143}
• CVE-2026-90104 -…

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop

rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter Negotiation) frame without checking for zero. When the remote peer sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg path to enter an infinite loop when fragmenting data, as each fragment has size == min_t(size_t, len, 0) == 0, so the remaining length never decreases. The infinite allocation of zero-length skbs exhausts all system memory.

Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated value is zero, consistent with the initial value assigned in rfcomm_dlc_alloc().

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter Negotiation) frame without checking for zero. When the remote peer sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg path to enter an infinite loop when fragmenting data, as each fragment has size == min_t(size_t, len, 0) == 0, so the remaining length never decreases. The infinite allocation of zero-length skbs exhausts all system memory. Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated value is zero, consistent with the initial value assigned in rfcomm_dlc_alloc().

These are all security issues fixed in the kernel-devel-7.2.7-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). -…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
• CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
• CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420). -…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23128: arm64: Set __nocfi on swsusp_arch_resume() (bsc#1258298).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31523: nvme-pci: ensure we're polling a polled queue (bsc#1263017).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-53090: bpf: Fix ld_{abs,ind} failure path analysis in subprogs (bsc#1269532).
• CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
• CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-72084: scsi: target: Bound PR-OUT TransportID parsing to the received buffer (bsc#1275540).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c:…

The SUSE Linux Enterprise 11 SP4 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68376: sctp: patch over auth_hmacs copy overflow (bsc#1274836).
• CVE-2026-72083: target: fix double unmap data sg in core_scsi3_emulate_pro_register_and_move() (bsc#1275535).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
• CVE-2026-74388: ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (bsc#1278253).
• CVE-2026-74556: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (bsc#1275696).
• CVE-2026-74588: sctp: keep chunk->transport in step with the list it is queued on (bsc#1277766).
• CVE-2026-74597: ip6_tunnel: clear skb2->cb in ip6ip6_err() (bsc#1277493).
• CVE-2026-74630: ipv6: prevent in6_dev_get() from resurrecting inet6_dev (bsc#1278191).
• CVE-2026-74641: ALSA: usx2y: bound the hwdep mmap fault offset (bsc#1278310).
• CVE-2026-74743: macvlan: inherit needed_headroom and needed_tailroom from lowerdev (bsc#1277908).
• CVE-2026-74752: sctp: validate cookie AUTH state before use (bsc#1278315).
• CVE-2026-80785: fbdev: serialize mode sysfs access with lock_fb_info() (bsc#1279619).
• CVE-2026-89479: sctp: stop processing a packet once its association is deleted (bsc#1280786).
• CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
• CVE-2026-90104: NFSv4.1: zero referring call lists before decoding (bsc#1281546).

The following non security issue was fixed:

• Disable BATMAN in supported.conf
• Disable CONFIG_BATMAN_ADV (jsc#PED-16892)
• Disable CONFIG_CAN (jsc#PED-17000)

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64373: cpufreq: Fix hotplug-suspend race during…

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-43502: net/rds: handle zerocopy send cleanup before the message is queued (bsc#1266008).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-53266: netfilter: bridge: make ebt_snat ARP rewrite writable (bsc#1269136).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63795: 9p: avoid putting oldfid in p9_client_walk() error path (bsc#1271955).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64556: perf/core: Detach event groups during remove_on_exec (bsc#1273251).
• CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() (bsc#1274037).
• CVE-2026-68162: sctp: avoid auth_enable sysctl UAF during netns teardown (bsc#1274920).
• CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket (bsc#1275977).
• CVE-2026-68376: sctp: fix auth_hmacs array size in struct sctp_cookie (bsc#1274836).
• CVE-2026-68445: drm/vc4: Prevent shader BO mappings from becoming writable (bsc#1276277).
• CVE-2026-68451: s390/zcrypt: Validate length for CCA ECC private key requests (bsc#1276287).
• CVE-2026-68452: s390/zcrypt: Validate length for CCA AES cipher key requests (bsc#1276295).
• CVE-2026-68454: KVM: s390: pci: Fix handling of AIF enable without AISB (bsc#1276388).
• CVE-2026-72051: net: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276801).
• CVE-2026-72052: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276803).
• CVE-2026-72053: net: ipip: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276814).
• CVE-2026-72054: net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276818).
• CVE-2026-72055: net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink (bsc#1276821).
• CVE-2026-72061: net: sit: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277249).
• CVE-2026-72066: cpu: hotplug: Bound hotplug states sysfs output (bsc#1277149).
• CVE-2026-72098: dm-verity: fix buffer overflow in FEC calculation (bsc#1275543).
• CVE-2026-72129: nvmet-rdma: handle inline data with a nonzero offset (bsc#1275545).
• CVE-2026-72136: xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink (bsc#1277574).
• CVE-2026-72157: net: thunderbolt: Fix frags[] overflow by bounding frame_count (bsc#1277544).
• CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters (bsc#1277553).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72322: ipv6: mcast: Fix potential UAF in MLD delayed work (bsc#1275972).
• CVE-2026-72323: ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (bsc#1275985).
• CVE-2026-72348: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (bsc#1276007).
• CVE-2026-72351: gue: validate REMCSUM private option length (bsc#1276009).
• CVE-2026-72383: sctp: fix addr_wq_timer race in sctp_free_addr_wq() (bsc#1277857).
• CVE-2026-72398: sctp: add INIT verification after cookie unpacking (bsc#1276381).
• CVE-2026-72399: net: enetc: check the number of BDs needed for xdp_frame (bsc#1276553).
• CVE-2026-72434: netfilter: ipset: make sure gc is properly stopped (bsc#1278054).
• CVE-2026-72449: drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (bsc#1278108).
• CVE-2026-74267: net/sched: sch_codel: Do not call…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
• CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
• CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts (bsc#1265138).
• CVE-2026-45834: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (bsc#1266412).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-46312: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (bsc#1267990).
• CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
• CVE-2026-53037: HID: usbhid: fix deadlock in hid_post_reset() (bsc#1269081).
• CVE-2026-53237: gpio: mvebu: fix NULL pointer dereference in suspend/resume (bsc#1269131).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (bsc#1271834).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1273953).
• CVE-2026-63897: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (bsc#1272642).
• CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check (bsc#1272499).
• CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers (bsc#1272517).
• CVE-2026-63903: USB: serial: belkin_sa: validate interrupt status length (bsc#1272522).
• CVE-2026-63904: usb: usbtmc: check URB actual_length for interrupt-IN notifications (bsc#1272523).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63942: parport: Fix race between port and client registration (bsc#1273023).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63957: USB: serial: safe_serial: fix memory corruption with small endpoint (bsc#1272472).
• CVE-2026-63961: usb: typec: altmodes/displayport: validate count before reading Status Update VDO (bsc#1272480).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (bsc#1273769).
• CVE-2026-64097: drm/amd/display: Validate GPIO pin LUT table size before iterating (bsc#1273480).
• CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length (bsc#1272211).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64320: nvmet: fix discover log page when offsets are used (bsc#1273420).
• CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect (bsc#1274011).
• CVE-2026-64348: usb: free iso schedules on failed submit (bsc#1274026).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).
• CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
• CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
• CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
• CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982). -…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-26730: hwmon: (nct6775) Fix access to temperature configuration registers (bsc#1222538).
• CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
• CVE-2026-23352: x86/efi: defer freeing of boot services memory (bsc#1260474).
• CVE-2026-31689: EDAC/mc: Fix error path ordering in edac_mc_alloc() (bsc#1263602).
• CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed (bsc#1264747).
• CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
• CVE-2026-45872: scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() (bsc#1266735).
• CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
• CVE-2026-46135: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (bsc#1267373).
• CVE-2026-46149: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (bsc#1267648).
• CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
• CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
• CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
• CVE-2026-53061: dm cache: fix dirty mapping checking in passthrough mode switching (bsc#1269685).
• CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
• CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails (bsc#1271817).
• CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1271906).
• CVE-2026-63883: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (bsc#1272572).
• CVE-2026-63890: scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (bsc#1272426).
• CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
• CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
• CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
• CVE-2026-63987: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (bsc#1272971).
• CVE-2026-63993: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (bsc#1279847).
• CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (bsc#1273782).
• CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
• CVE-2026-64038: hwmon: (lm90) Stop work before releasing hwmon device (bsc#1273750).
• CVE-2026-64046: net: tls: prevent chain-after-chain in plain text SG (bsc#1273059).
• CVE-2026-64103: scsi: isci: Fix use-after-free in device removal path (bsc#1273759).
• CVE-2026-64173: tracing: Do not call map->ops->elt_free() if elt_alloc() fails (bsc#1272145).
• CVE-2026-64205: i2c: i801: fix hardware state machine corruption in error path (bsc#1272215).
• CVE-2026-64210: net/mlx5e: xsk: Fix unlocked writing to ICOSQ (bsc#1273899).
• CVE-2026-64213: hwmon: (lm90) Add lock protection to lm90_alert (bsc#1272793).
• CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
• CVE-2026-64283: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (bsc#1273870).
• CVE-2026-64297: module: decompress: check return value of module_extend_max_pages() (bsc#1273938).
• CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
• CVE-2026-64319: nvmet-auth: validate reply message payload bounds against transfer length (bsc#1273339).
• CVE-2026-64320: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (bsc#1273420).
• CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
• CVE-2026-64373: cpufreq: Fix hotplug-suspend race during…

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74624: netfilter: conntrack: work around exceeded receive window (bsc#1277599).
• CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
• CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget (bsc#1280743).
• CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
• CVE-2026-89669: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280251).
• CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
• CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
• CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851).
• CVE-2026-97564: smb: client: reject userspace cifs.idmap descriptions (bsc#1283946).
• CVE-2026-98015: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (bsc#1283963).
• CVE-2026-98016: net/mlx5e: Fix use-after-free race in sample_restore_put() (bsc#1283894).
• CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons (bsc#1284064).
• CVE-2026-98130: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (bsc#1283835).
• CVE-2026-98248: arm64: Use load LSE atomics for the non-return per-CPU atomic operations (bsc#1284518).
• CVE-2026-98253: RDMA/ucma: Serialize join and leave on copy_to_user failure (bsc#1284790).
• CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread() (bsc#1284408).
• CVE-2026-98323: RDMA/siw: Bound fragmented header copies by the remaining length (bsc#1284713).
• CVE-2026-98357: IB/isert: wait for deferred control PDU completions before releasing the connection (bsc#1284791).
• CVE-2026-98359: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (bsc#1284746).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).
• CVE-2026-99999: ipv4: validate checksum_start before completing checksum (bsc#1285684).

The following non security issues were fixed:

• kernel-binary.spec.in: Emulate kabi.pl error when suse-kabi-tools is used.
• netfilter: nfnetlink_queue: unbreak SCTP traffic (bsc#1285684).

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-39468: smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103 bsc#1280176).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74624: netfilter: conntrack: work around exceeded receive window (bsc#1277599).
• CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
• CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget (bsc#1280743).
• CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
• CVE-2026-89669: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280251).
• CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
• CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
• CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851).
• CVE-2026-97564: smb: client: reject userspace cifs.idmap descriptions (bsc#1283946).
• CVE-2026-98015: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (bsc#1283963).
• CVE-2026-98016: net/mlx5e: Fix use-after-free race in sample_restore_put() (bsc#1283894).
• CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons (bsc#1284064).
• CVE-2026-98130: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (bsc#1283835).
• CVE-2026-98248: arm64: Use load LSE atomics for the non-return per-CPU atomic operations (bsc#1284518).
• CVE-2026-98253: RDMA/ucma: Serialize join and leave on copy_to_user failure (bsc#1284790).
• CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread() (bsc#1284408).
• CVE-2026-98323: RDMA/siw: Bound fragmented header copies by the remaining length (bsc#1284713).
• CVE-2026-98357: IB/isert: wait for deferred control PDU completions before releasing the connection (bsc#1284791).
• CVE-2026-98359: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (bsc#1284746).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).
• CVE-2026-99999: ipv4: validate checksum_start before completing checksum (bsc#1285684).

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74624: netfilter: conntrack: work around exceeded receive window (bsc#1277599).
• CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
• CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget (bsc#1280743).
• CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
• CVE-2026-89669: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280251).
• CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
• CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
• CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851).
• CVE-2026-97564: smb: client: reject userspace cifs.idmap descriptions (bsc#1283946).
• CVE-2026-98015: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (bsc#1283963).
• CVE-2026-98016: net/mlx5e: Fix use-after-free race in sample_restore_put() (bsc#1283894).
• CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons (bsc#1284064).
• CVE-2026-98130: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (bsc#1283835).
• CVE-2026-98248: arm64: Use load LSE atomics for the non-return per-CPU atomic operations (bsc#1284518).
• CVE-2026-98253: RDMA/ucma: Serialize join and leave on copy_to_user failure (bsc#1284790).
• CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread() (bsc#1284408).
• CVE-2026-98323: RDMA/siw: Bound fragmented header copies by the remaining length (bsc#1284713).
• CVE-2026-98357: IB/isert: wait for deferred control PDU completions before releasing the connection (bsc#1284791).
• CVE-2026-98359: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (bsc#1284746).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).
• CVE-2026-99999: ipv4: validate checksum_start before completing checksum (bsc#1285684).

The following non security issue was fixed:

• netfilter: nfnetlink_queue: unbreak SCTP traffic (bsc#1285684).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2024-39468: smb: client: fix deadlock in smb2_find_smb_tcon() (bsc#1227103, bsc#1280176).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74624: netfilter: conntrack: work around exceeded receive window (bsc#1277599).
• CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
• CVE-2026-89528: svcrdma: Reject Read lists that exceed the page budget (bsc#1280743).
• CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
• CVE-2026-89669: nfsd: fix cpntf publish race in nfs4_init_cp_state (bsc#1280251).
• CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
• CVE-2026-90088: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (bsc#1281397).
• CVE-2026-97555: smb: client: fix heap overflow in DACL owner/group rewrite (bsc#1283851).
• CVE-2026-97564: smb: client: reject userspace cifs.idmap descriptions (bsc#1283946).
• CVE-2026-98015: net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (bsc#1283963).
• CVE-2026-98016: net/mlx5e: Fix use-after-free race in sample_restore_put() (bsc#1283894).
• CVE-2026-98041: bpf: Don't predict JMP32 pointer vs zero comparisons (bsc#1284064).
• CVE-2026-98130: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (bsc#1283835).
• CVE-2026-98248: arm64: Use load LSE atomics for the non-return per-CPU atomic operations (bsc#1284518).
• CVE-2026-98253: RDMA/ucma: Serialize join and leave on copy_to_user failure (bsc#1284790).
• CVE-2026-98260: exec: Cleanup POSIX timers right after de_thread() (bsc#1284408).
• CVE-2026-98323: RDMA/siw: Bound fragmented header copies by the remaining length (bsc#1284713).
• CVE-2026-98357: IB/isert: wait for deferred control PDU completions before releasing the connection (bsc#1284791).
• CVE-2026-98359: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (bsc#1284746).
• CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period (bsc#1285685).
• CVE-2026-99999: ipv4: validate checksum_start before completing checksum (bsc#1285684).

The following non security issue was fixed:

• netfilter: nfnetlink_queue: unbreak SCTP traffic (bsc#1285684).

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop rfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter Negotiation) frame without checking for zero. When the remote peer sends an MTU of zero, d->mtu is set to 0. This causes the sendmsg path to enter an infinite loop when fragmenting data, as each fragment has size == min_t(size_t, len, 0) == 0, so the remaining length never decreases. The infinite allocation of zero-length skbs exhausts all system memory. Fix by clamping d->mtu to RFCOMM_DEFAULT_MTU when the negotiated value is zero, consistent with the initial value assigned in rfcomm_dlc_alloc().

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system; …

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• SMB network file system;
• SquashFS file system;
• UBI file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• IPv4 networking;
• Internal shared memory driver;
• Networking core;
• Scheduler infrastructure;
• Sun RPC protocol;
• Virtio network driver;
• Amateur Radio drivers;
• IP tunnels definitions;
• Network…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• User-space API (UAPI);
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Speakup Console Speech Driver;
• ACPI drivers;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Bluetooth drivers;
• Cdrom driver;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DAX dirext access to differentiated memory framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• Intel Trace Hub HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Generic PM domains;
• System reset/shutdown drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• Reset controller framework;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Media Oriented Systems Transport (MOST) driver;
• NVIDIA Tegra embedded controller (NVEC)…