CVE-2026-98171

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames: - Clear next_buffer after assigning it to server->bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths. - Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue. - Reject next_cmd values smaller than MID_HEADER_SIZE(server). - Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames: - Clear next_buffer after assigning it to server->bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths. - Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue. - Reject next_cmd values smaller than MID_HEADER_SIZE(server). - Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs

Fix several related bounds checking and pointer lifecycle issues in receive_encrypted_standard()'s handling of compound encrypted frames:

• Clear next_buffer after assigning it to server->bigbuf. A stale next_buffer pointer can lead to a use-after-free on subsequent error paths.
• Update pdu_length to the decrypted plaintext size (buf_size). Using the pre-decryption length allows NextCommand to point into stale ciphertext residue.
• Reject next_cmd values smaller than MID_HEADER_SIZE(server).
• Fix an integer overflow in the upper bound check by verifying pdu_length - next_cmd < MID_HEADER_SIZE(server), ensuring the trailing slice is large enough for a header.

• CVE-2026-99999
  • ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• CVE-2026-43250
  • usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() {CVE-2026-43250}
• CVE-2026-43281
  • mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281}
• CVE-2025-38595
  • xen: fix UAF in dmabuf_exp_from_pages() {CVE-2025-38595}
• CVE-2026-89610
  • ntfs: verify run length exceeding volume boundary {CVE-2026-89610}
• CVE-2026-74540
  • Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540}
• CVE-2023-52935
  • mm/khugepaged: fix ->anon_vma race {CVE-2023-52935}
• CVE-2026-64225
  • octeontx2-af: CGX: add bounds check to cgx_speed_mbps index {CVE-2026-64225}
• CVE-2026-31489
  • spi: meson-spicc: Fix double-put in remove path {CVE-2026-31489}
• CVE-2026-53068
  • drm/komeda: fix integer overflow in AFBC framebuffer size check {CVE-2026-53068}
• CVE-2026-64249
  • fpga: region: fix use-after-free in child_regions_with_firmware() {CVE-2026-64249}
• CVE-2026-64007
  • netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007}
• CVE-2026-98320
  • netfilter: flowtable: hold reference on ct until flow is released {CVE-2026-98320}
• CVE-2026-98248
  • arm64: percpu: Fix LSE operations on {8,16}-bit types {CVE-2026-98248}
• CVE-2026-98375
  • xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• CVE-2026-98312
  • ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312}
• CVE-2026-98269
  • btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269}
• CVE-2026-98194
  • wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194}
• CVE-2026-98354
  • RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• CVE-2026-64015
  • security/keys: fix missed RCU read section on lookup {CVE-2026-64015}
• CVE-2026-63800
  • pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
• CVE-2026-98349
  • wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349}
• CVE-2026-98348
  • wifi: libipw: reject too-short association responses {CVE-2026-98348}
• CVE-2026-98217
  • IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217}
• CVE-2026-98196
  • wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196}
• CVE-2026-64002
  • ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002}
• CVE-2026-52923
  • ipc: limit next_id allocation to the valid ID range {CVE-2026-52923}
• CVE-2026-98276
  • net: lock the socket in sock_gettstamp() {CVE-2026-98276}
• CVE-2026-63967
  • iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer {CVE-2026-63967}
• CVE-2026-63912
  • xfrm: esp: restore combined single-frag length gate {CVE-2026-63912}
• CVE-2026-98193
  • wifi: libipw: reject TKIP frames without a full MIC {CVE-2026-98193}
• CVE-2026-98185
  • wifi: mwifiex: validate scan response extents {CVE-2026-98185}
• CVE-2026-98171
  • smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171}
• CVE-2026-97540
  • net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• CVE-2026-97608
  • netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• CVE-2026-97908
  • Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev {CVE-2026-97908}
• CVE-2026-93830
  • net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830}
• CVE-2026-93817
  • perf: Fix addr_filter_ranges lifetime {CVE-2026-93817}
• CVE-2026-98017
  • net/sched:…

• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057}
• mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• net: Introduce skb tc depth field to track packet loops {CVE-2026-63983}
• ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255}
• net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157}
• SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550}
• rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436}
• isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
• ata: libata-core: Reject an invalid concurrent positioning ranges count {CVE-2026-72030}
• wifi: mac80211: validate extension-frame layout before RX {CVE-2026-68470}
• wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() {CVE-2026-68470}
• drm/amd/pm: fix pptable use-after-free {CVE-2026-74450}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: clear ce->tgthint in free_tgts() {CVE-2026-89636}
• smb: client: harden DFS cache against invalid target hints {CVE-2026-93210}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553}
• HID: sony: clean up device list on probe failure {CVE-2026-90041}
• drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175}
• hwrng: core - fix rng list on registration error {CVE-2026-93163}
• RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104}
• fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() {CVE-2026-93100}
• bpf: Fix potential UAF when reading bpf link info {CVE-2026-90392}
• HID: synchronize input before cleaning up a failed probe {CVE-2026-90329}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171}
• netfilter: cttimeout: prevent UAF during module unload {CVE-2026-97609}
• thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826}
• configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367}
• ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312}
• scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887}
• scsi: target: Fix hexadecimal CHAP_I handling {CVE-2026-63886}
• scsi: target: iscsi: Validate CHAP_R length before base64 decode {CVE-2026-63886}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• nfsd: RCU-protect cl_cb_session to fix…

These are all security issues fixed in the kernel-devel-7.2.10-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
• CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
• CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
• CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
• CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
• CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
• CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
• CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
• CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
• CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
• CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
• CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
• CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
• CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
• CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
• CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
• CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
• CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
• CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
• CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
• CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
• CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
• CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
• CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
• CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
• CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
• CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
• CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
• CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
• CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
• CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
• CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
• CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
• CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
• CVE-2026-72127: netdev-genl: report NAPI thread PID in the caller's pid namespace (bsc#1277542).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
• CVE-2026-72400: seg6: validate SRH length before reading fixed fields (bsc#1278030).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
• CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74399: evm: terminate and bound the evm_xattrs read buffer (bsc#1278319).
• CVE-2026-74565: netfilter: nf_tables: make nft_object rhltable per table (bsc#1275568).
• CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
• CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
• CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
• CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
• CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574).
• CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
• CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
• CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
• CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
• CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
• CVE-2026-80684: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277467).
• CVE-2026-80709: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (bsc#1278202).
• CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
• CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
• CVE-2026-80757: selinux: reject a…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…