CVE-2026-98358

• Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284}
• usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
• usb: usbfs: fix use-after-free of usb_device in usbdev_release() {CVE-2026-80824}
• HID: alps: fix use-after-free on input2 registration failure {CVE-2026-98501}
• scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() {CVE-2023-53754}
• net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}
• net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488}
• net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489}
• net: ena: fix MMIO read buffer leak on probe failure {CVE-2026-98486}
• HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
• net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}
• RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067}
• libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
• nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}
• net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377}
• RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• ALSA: usbusx2y: validate URB actual_length in interrupt callback {CVE-2026-97929}
• ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf {CVE-2026-97930}
• udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
• PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
• wifi: iwlwifi: mvm: validate TX_CMD response layout {CVE-2026-93793}
• smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid {CVE-2026-97561}
• wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345}
• IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
• IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294}
• NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151}
• sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
• RDMA/core: Reject unregistering netdevs in ib_get_eth_speed {CVE-2026-98359}
• ipv6: mcast: use rcu_assign_pointer() for __rcu list updates {CVE-2026-98099}
• wifi: cfg80211: reject duplicate wiphy cipher suite entries {CVE-2026-97518}
• IB/iser: reject a remote invalidation of an unregistered direction {CVE-2026-98358}
• ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
• mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048}
• misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
• ACPI: bus: Introduce acpi_bus_get_primary_device() {CVE-2026-93251}
• scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
• smb: client: reject a tree connect response whose byte count is too small {CVE-2026-89631}
• tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847}
• fsnotify: Fix stale object mask after concurrent mark updates {CVE-2026-89595}
• smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638}
• sunrpc: init…

In the Linux kernel, the following vulnerability has been resolved:

IB/iser: reject a remote invalidation of an unregistered direction

A write command whose data is sent entirely as immediate data is not registered. iser_reg_mem_fastreg() takes the DMA key path and leaves rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has already set dir[ISER_DIR_OUT].

iser_check_remote_inv() looks at dir[] alone and hands the descriptor to iser_inv_desc(), which reads desc->sig_protected. A target that answers such a command with IB_WR_SEND_WITH_INV faults the initiator. Leaving those commands unregistered is deliberate.

The same function already terminates the connection when a target sends a remote invalidation the initiator did not ask for. A target that invalidates a direction that was never registered is in the same class, so give it the same answer.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: rxe_wq do_work RIP: 0010:iser_task_rsp+0x6d6/0xec0 Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04 RSP: 0018:ffff88811b008db8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848 RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020 RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0 R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800 R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <IRQ> __ib_process_cq+0xe1/0x390 ib_poll_handler+0x6e/0x200 irq_poll_softirq+0x1df/0x480 ? clockevents_program_event+0x2ba/0x860 ? __pfx_irq_poll_softirq+0x10/0x10 handle_softirqs+0x18e/0x590 ? __pfx_handle_softirqs+0x10/0x10 ? __hrtimer_rearm_deferred+0x156/0x450 do_softirq+0x3b/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x61/0x70 __alloc_skb+0x732/0x890 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx___alloc_skb+0x10/0x10 ? _raw_read_unlock_irqrestore+0x16/0x50 rxe_init_packet+0x16b/0x4f0 prepare_ack_packet+0xb8/0x830 rxe_receiver+0x499/0x9980 ? __pfx_rxe_receiver+0x10/0x10 ? rxe_completer+0x29e5/0x38c0 ? hrtimer_start_range_ns_common+0x75f/0x1730 ? hrtimer_start_range_ns+0xa6/0x2c0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx_rxe_receiver+0x10/0x10 do_work+0x144/0x470 process_one_work+0x633/0x1030 ? assign_work+0x11d/0x370 worker_thread+0x45b/0xd10 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c6/0x3b0 ? recalc_sigpending+0x15c/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x36e/0x5a0 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x572/0xdd0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]---

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iser_reg_mem_fastreg() takes the DMA key path and leaves rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has already set dir[ISER_DIR_OUT]. iser_check_remote_inv() looks at dir[] alone and hands the descriptor to iser_inv_desc(), which reads desc->sig_protected. A target that answers such a command with IB_WR_SEND_WITH_INV faults the initiator. Leaving those commands unregistered is deliberate. The same function already terminates the connection when a target sends a remote invalidation the initiator did not ask for. A target that invalidates a direction that was never registered is in the same class, so give it the same answer. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: rxe_wq do_work RIP: 0010:iser_task_rsp+0x6d6/0xec0 Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04 RSP: 0018:ffff88811b008db8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848 RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020 RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0 R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800 R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <IRQ> __ib_process_cq+0xe1/0x390 ib_poll_handler+0x6e/0x200 irq_poll_softirq+0x1df/0x480 ? clockevents_program_event+0x2ba/0x860 ? __pfx_irq_poll_softirq+0x10/0x10 handle_softirqs+0x18e/0x590 ? __pfx_handle_softirqs+0x10/0x10 ? __hrtimer_rearm_deferred+0x156/0x450 do_softirq+0x3b/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x61/0x70 __alloc_skb+0x732/0x890 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx___alloc_skb+0x10/0x10 ? _raw_read_unlock_irqrestore+0x16/0x50 rxe_init_packet+0x16b/0x4f0 prepare_ack_packet+0xb8/0x830 rxe_receiver+0x499/0x9980 ? __pfx_rxe_receiver+0x10/0x10 ? rxe_completer+0x29e5/0x38c0 ? hrtimer_start_range_ns_common+0x75f/0x1730 ? hrtimer_start_range_ns+0xa6/0x2c0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx_rxe_receiver+0x10/0x10 do_work+0x144/0x470 process_one_work+0x633/0x1030 ? assign_work+0x11d/0x370 worker_thread+0x45b/0xd10 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c6/0x3b0 ? recalc_sigpending+0x15c/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x36e/0x5a0 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x572/0xdd0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]---

These are all security issues fixed in the kernel-devel-7.2.10-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
• CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
• CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
• CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
• CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
• CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (bsc#1274008).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
• CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
• CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (bsc#1274008).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
• CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
• CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
• CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
• CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
• CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
• CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
• CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
• CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
• CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
• CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
• CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
• CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
• CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
• CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
• CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
• CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
• CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-31731: thermal: core: Address thermal zone removal races with resume (bsc#1264042).
• CVE-2026-46028: crypto: algif_aead - snapshot IV for async AEAD requests (bsc#1267430).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: net: skmsg: preserve sg.copy across SG transforms (bsc#1272178).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64058: netfs: Fix netfs_read_folio() to wait on writeback (bsc#1272898).
• CVE-2026-64060: netfs: Fix leak of request in netfs_write_begin() error handling (bsc#1272901).
• CVE-2026-64062: netfs: Fix potential deadlock in write-through mode (bsc#1272952).
• CVE-2026-64063: netfs: Fix streaming write being overwritten (bsc#1272955).
• CVE-2026-64064: netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (bsc#1272956).
• CVE-2026-64068: netfs: Fix missing locking around retry adding new subreqs (bsc#1272509).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72174: fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() (bsc#1277695).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72355: netfs: Fix barriering when walking subrequest list (bsc#1276330).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74306: vfio/qat: fix f_pos race in qat_vf_resume_write() (bsc#1276907).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (bsc#1274008).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
• CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
• CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-64568: wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure (bsc#1274008).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74611: tls: rx: restore msg_iter before TLS 1.3 optimistic retry (bsc#1277804).
• CVE-2026-74614: vsock/virtio: read virtqueues under worker locks (bsc#1277931).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74723: btrfs: lzo: reject inline extents without valid headers (bsc#1276562).
• CVE-2026-80579: fbdev: clear fb_info->mode before deleting a videomode…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2023-54158: btrfs: don't free qgroup space unless specified (bsc#1256076).
• CVE-2023-54180: btrfs: handle case when repair happens with dev-replace (bsc#1255995).
• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-63948: Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (bsc#1272670).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64456: hwrng: virtio: clamp device-reported used.len at copy_data() (bsc#1273288).
• CVE-2026-64593: btrfs: do not trim a device which is not writeable (bsc#1274497).
• CVE-2026-68106: drm/amdgpu: fix division by zero with invalid uvd dimensions (bsc#1274853).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68236: drm/amd/display: set new_stream to NULL after release (bsc#1275659).
• CVE-2026-68303: drm/vc4: hvs/v3d: Fix null dereference in unbind (bsc#1275080).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-68430: drm/amdgpu/gfx8: drop unecessary BUG_ON() (bsc#1276273).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72319: ipvs: ensure inner headers in ICMP errors are in headroom (bsc#1275964).
• CVE-2026-72476: dmaengine: Fix possible use after free (bsc#1276844).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74408: wifi: ath9k: fix OOB access from firmware tx status queue ID (bsc#1276387).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587: sctp: fix use-after-free of cached ASCONF chunk (bsc#1277821).
• CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx (bsc#1277310).
• CVE-2026-74675: vt: stabilize tty reference in kbd_keycode with tty_port_tty_get (bsc#1278313).
• CVE-2026-80977: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (bsc#1280259).
• CVE-2026-89542: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (bsc#1280387).
• CVE-2026-89726: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (bsc#1281058).
• CVE-2026-89778: isofs: fix out-of-bounds page array access on empty zisofs block (bsc#1280966).
• CVE-2026-89987: mm/huge_memory: transfer the pmd dirty bit to the folio on zap (bsc#1281819).
• CVE-2026-90011: scsi: target: iscsi: Reserve a terminator byte for the login payload (bsc#1281280).
• CVE-2026-90283: hugetlbfs: release subpool on fill_super failure (bsc#1281771).
• CVE-2026-93252: ocfs2: make ocfs2_set_acl() static (bsc#1282784).
• CVE-2026-93287: i2c: smbus: reject oversized block transfers in the common path (bsc#1282744).
• CVE-2026-93800: btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (bsc#1282808).
• CVE-2026-93820: PCI: rockchip: Protect root bus removal with rescan lock (bsc#1282755).
• CVE-2026-93822: PCI: iproc: Protect root bus removal with rescan lock (bsc#1282762).
• CVE-2026-97416: btrfs: balance: fix potential…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889).
• CVE-2026-74587:…

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43132: dm-verity: correctly handle dm_bufio_client_create() failure (bsc#1264614).
• CVE-2026-43184: rnbd-srv: Zero the rsp buffer before using it (bsc#1264622).
• CVE-2026-43283: net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (bsc#1264295).
• CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
• CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path (bsc#1265000).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-46034: vfio/cdx: Fix NULL pointer dereference in interrupt trigger path (bsc#1266757).
• CVE-2026-53108: powerpc/64s: Fix unmap race with PMD migration entries (bsc#1269561).
• CVE-2026-63830: bpf, sockmap: Several fixes to bpf_msg_push_data (bsc#1272178).
• CVE-2026-63983: net: Introduce skb tc depth field to track packet loops (bsc#1273040).
• CVE-2026-64012: net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1273764).
• CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths (bsc#1273116).
• CVE-2026-64116: ipv6: ioam: add NULL check for idev in ipv6_hop_ioam() (bsc#1273751).
• CVE-2026-64280: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (bsc#1273599).
• CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (bsc#1273290).
• CVE-2026-64424: netpoll: fix a use-after-free on shutdown path (bsc#1274256).
• CVE-2026-64428: gpio: sch: use raw_spinlock_t in the irq startup path (bsc#1274039).
• CVE-2026-64461: PCI: mediatek: Fix IRQ domain leak when port fails to enable (bsc#1273865).
• CVE-2026-68233: drm/vc4: Shut down BO cache timer before teardown (bsc#1275644).
• CVE-2026-68241: drm/i915/mst: limit DP MST ESI service loop (bsc#1275785).
• CVE-2026-68242: drm/i915/gt: Fix NULL deref on sched_engine alloc failure (bsc#1275786).
• CVE-2026-68323: tipc: serialize udp bearer replicast list updates (bsc#1274653).
• CVE-2026-72015: fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list (bsc#1276791).
• CVE-2026-72040: ipmi: fix refcount leak in i_ipmi_request() (bsc#1276836).
• CVE-2026-72041: espintcp: use sk_msg_free_partial to fix partial send (bsc#1275510).
• CVE-2026-72081: scsi: elx: efct: Fix I/O leak on unsupported additional CDB (bsc#1277174).
• CVE-2026-72172: mm/mm_init: fix uninitialized struct pages for ZONE_DEVICE (bsc#1277691).
• CVE-2026-72212: mm/memory_hotplug: fix incorrect altmap passing in error path (bsc#1277602).
• CVE-2026-72213: mm/hugetlb: fix hugetlb cgroup rsvd charge/uncharge mismatch (bsc#1277603).
• CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (bsc#1277614).
• CVE-2026-72301: ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (bsc#1277742).
• CVE-2026-72305: VDUSE: avoid leaking information to userspace (bsc#1277747).
• CVE-2026-72319: ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (bsc#1275964).
• CVE-2026-72493: net: serialize netif_running() check in enqueue_to_backlog() (bsc#1276951).
• CVE-2026-74312: vhost/vdpa: validate virtqueue index in mmap and fault paths (bsc#1276873).
• CVE-2026-74379: dax/kmem: account for partial discontiguous resource upon removal (bsc#1278232).
• CVE-2026-74544: net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (bsc#1277894).
• CVE-2026-74578: crypto: algif_skcipher - force synchronous processing on trees without ctx->state (bsc#1275564).
• CVE-2026-74583: net/sched: cls_route: fix fastmap use-after-free on filter (bsc#1277889). -…

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iser_reg_mem_fastreg() takes the DMA key path and leaves rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has already set dir[ISER_DIR_OUT]. iser_check_remote_inv() looks at dir[] alone and hands the descriptor to iser_inv_desc(), which reads desc->sig_protected. A target that answers such a command with IB_WR_SEND_WITH_INV faults the initiator. Leaving those commands unregistered is deliberate. The same function already terminates the connection when a target sends a remote invalidation the initiator did not ask for. A target that invalidates a direction that was never registered is in the same class, so give it the same answer. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: rxe_wq do_work RIP: 0010:iser_task_rsp+0x6d6/0xec0 Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04 RSP: 0018:ffff88811b008db8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848 RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020 RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0 R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800 R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <IRQ> __ib_process_cq+0xe1/0x390 ib_poll_handler+0x6e/0x200 irq_poll_softirq+0x1df/0x480 ? clockevents_program_event+0x2ba/0x860 ? __pfx_irq_poll_softirq+0x10/0x10 handle_softirqs+0x18e/0x590 ? __pfx_handle_softirqs+0x10/0x10 ? __hrtimer_rearm_deferred+0x156/0x450 do_softirq+0x3b/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x61/0x70 __alloc_skb+0x732/0x890 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx___alloc_skb+0x10/0x10 ? _raw_read_unlock_irqrestore+0x16/0x50 rxe_init_packet+0x16b/0x4f0 prepare_ack_packet+0xb8/0x830 rxe_receiver+0x499/0x9980 ? __pfx_rxe_receiver+0x10/0x10 ? rxe_completer+0x29e5/0x38c0 ? hrtimer_start_range_ns_common+0x75f/0x1730 ? hrtimer_start_range_ns+0xa6/0x2c0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx_rxe_receiver+0x10/0x10 do_work+0x144/0x470 process_one_work+0x633/0x1030 ? assign_work+0x11d/0x370 worker_thread+0x45b/0xd10 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c6/0x3b0 ? recalc_sigpending+0x15c/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x36e/0x5a0 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x572/0xdd0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]---

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system; …

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• User-space API (UAPI);
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Speakup Console Speech Driver;
• ACPI drivers;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Bluetooth drivers;
• Cdrom driver;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DAX dirext access to differentiated memory framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• Intel Trace Hub HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Generic PM domains;
• System reset/shutdown drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• Reset controller framework;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Media Oriented Systems Transport (MOST) driver;
• NVIDIA Tegra embedded controller (NVEC)…