CVE-2026-23398

The Linux Kernel, the operating system core itself.

Security Fix(es):

IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.(CVE-2025-27558)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ife: Fix metalist update behavior

Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the new metadata. Aside from being innapropriate behavior, this may lead to an unbounded addition of metadata to the metalist which might cause an out of bounds error when running the encode op:

[ 138.423369][ C1] ================================================================== [ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255 [ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full) [ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 138.425800][ C1] Call Trace: [ 138.425804][ C1] <IRQ> [ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122) [ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597) [ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1)) [ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2)) [ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171) [ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57) [ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) [ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3)) [ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45) [ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)

To solve this issue, fix the replace behavior by adding the metalist to the ife rcu data structure.(CVE-2026-23378)

In the Linux kernel, the following vulnerability has been resolved:

icmp: fix NULL pointer dereference in icmp_tag_validation()

icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN:…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

icmp: fix NULL pointer dereference in icmp_tag_validation()

icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: <IRQ> icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) </IRQ>

Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation.(CVE-2026-23398)

In the Linux kernel, the following vulnerability has been resolved:

net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check

The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB.

Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly.

Compile-tested only.(CVE-2026-23447)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: teql: Fix double-free in teql_master_xmit

Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racing with the datapath. Failure to do so may cause crashes like the following:

[ 238.028993][ T318] BUG: KASAN: double-free in skb_release_data (net/core/skbuff.c:1139) [ 238.029328][ T318] Free of addr ffff88810c67ec00 by task poc_teql_uaf_ke/318 [ 238.029749][ T318] [ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: poc_teql_ke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full) [ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 238.029910][ T318] Call Trace: [ 238.029913][ T318] <TASK> [ 238.029916][ T318] dump_stack_lvl (lib/dump_stack.c:122) [ 238.029928][ T318] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 238.029940][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029944][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.029957][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029969][ T318] kasan_report_invalid_free (mm/kasan/report.c:221 mm/kasan/report.c:563) [ 238.029979][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029989][ T318] check_slab_allocation (mm/kasan/common.c:231) [ 238.029995][ T318] kmem_cache_free (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1)) [ 238.030004][ T318] skb_release_data (net/core/skbuff.c:1139) ... [ 238.030025][ T318] sk_skb_reason_drop (net/core/skbuff.c:1256) [ 238.030032][ T318] pfifo_fast_reset (./include/linux/ptr_ring.h:171 ./include/linux/ptr_ring.h:309 ./include/linux/skb_array.h:98 net/sched/sch_generic.c:827) [ 238.030039][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ …

The Linux Kernel, the operating system core itself.

Security Fix(es):

IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.(CVE-2025-27558)

In the Linux kernel, a security vulnerability exists in the IOMMU Shared Virtual Addressing (SVA) feature. On x86 architecture when CONFIG_X86 is set, IOMMU hardware caches kernel page table entries. Due to the lack of notification mechanism for kernel page table changes, when kernel page table pages are freed and reused, the IOMMU may retain stale entries, leading to Use-After-Free (UAF) and Write-After-Free (WAF) conditions. This can be exploited to cause arbitrary physical memory DMA access or privilege escalation.(CVE-2025-71089)

In the Linux kernel, the following vulnerability has been resolved:

uacce: fix cdev handling in the cleanup path

When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove.(CVE-2026-23096)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ife: Fix metalist update behavior

Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the new metadata. Aside from being innapropriate behavior, this may lead to an unbounded addition of metadata to the metalist which might cause an out of bounds error when running the encode op:

[ 138.423369][ C1] ================================================================== [ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255 [ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full) [ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 138.425800][ C1] Call Trace: [ 138.425804][ C1] <IRQ> [ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122) [ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597) [ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1)) [ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2)) [ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171) [ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57) [ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) [ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3)) [ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45) [ 138.425927][ C1] ? srso_alias_return_thunk…

Root has patched CVE-2026-23398 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-23398 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-23398 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2026-23398 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-23398 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: <IRQ> icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) </IRQ> Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation.

In the Linux kernel, the following vulnerability has been resolved:

icmp: fix NULL pointer dereference in icmp_tag_validation()

icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: <IRQ> icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) </IRQ>

Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation.

• net: skbuff: propagate shared-frag marker through pskb_copy()
• HID: ignore non-functional sensor in HP 5MP Camera {CVE-2025-21992}
• net: fix crash when config small gso_max_size/gso_ipv4_max_size {CVE-2024-50258}
• ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() {CVE-2024-53042}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• serial: imx: Add missing .thaw_noirq hook {CVE-2022-49841}
• module: ensure that kobject_put() is safe for module type kobjects {CVE-2025-37995}
• udf: Fix uninitialized array access for some pathnames {CVE-2023-53165}
• ACPICA: Avoid undefined behavior: applying zero offset to null pointer {CVE-2023-53182}
• net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
• platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data {CVE-2026-23370}
• HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
• ice: Fix memory leak in ice_set_ringparam() {CVE-2026-23389}
• wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
• HID: asus: avoid memory leak in asus_report_fixup() {CVE-2026-31524}
• xprtrdma: treat all calls not a bcall when bc_serv is NULL {CVE-2022-49321}
• mm/mempolicy: fix uninit-value in mpol_rebind_policy() {CVE-2022-49567}
• x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails {CVE-2022-49549}
• af_unix: Fix a data-race in unix_dgram_peer_wake_me(). {CVE-2022-49344}
• bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data {CVE-2022-50536}
• net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() {CVE-2023-53578}
• wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() {CVE-2023-53570}
• mptcp: fix race on unaccepted mptcp sockets {CVE-2022-49669}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() {CVE-2026-23315}
• net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check {CVE-2026-23447}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• apparmor: Fix double free of ns_name in aa_replace_profiles() {CVE-2026-23408}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• i2c: piix4: Fix a memory leak in the EFCH MMIO support {CVE-2022-49653}

• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
• wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
• drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• smb: client: reject userspace cifs.spnego descriptions
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}

• net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
• net: add xmit recursion limit to tunnel xmit functions {CVE-2026-23276}
• x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 {CVE-2026-23005}
• wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
• net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY {CVE-2025-37945}
• xfs: delete attr leaf freemap entries when empty {CVE-2026-43158}
• ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183}
• crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
• scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list {CVE-2023-53627}
• bonding: annotate data-races around slave->last_rx {CVE-2026-23212}
• rxrpc: Fix data-race warning and potential load/store tearing {CVE-2026-23118}
• net: phy: register phy led_triggers during probe to avoid AB-BA deadlock {CVE-2026-23368}
• tracing: Do not register unsupported perf events {CVE-2025-71125}
• ACPICA: Avoid walking the Namespace if start_node is NULL {CVE-2025-71118}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• nfc: rawsock: cancel tx_work before socket teardown {CVE-2026-23372}
• bridge: cfm: Fix race condition in peer_mep deletion {CVE-2026-23393}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622}
• bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue {CVE-2024-36938}
• virtiofs: use pages instead of pointer for kernel direct IO {CVE-2024-53219}
• acct: perform last write from workqueue {CVE-2025-21846}
• NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
• atm: clip: Fix memory leak of struct clip_vcc. {CVE-2025-38546}
• efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}

• Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek
• sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison {CVE-2026-53309}
• ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043}
• ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
• wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
• drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• mm:…

In the Linux kernel, the following vulnerability has been resolved:

icmp: fix NULL pointer dereference in icmp_tag_validation()

icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: <IRQ> icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) </IRQ>

Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation.

Upstream kernel version 6.6.130 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.6.130 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
• CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets…

The SUSE Linux Enterprise 15 SP3 kernel was updated to fix various security issues.

The following security issues were fixed:

• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation() (bsc#1260730).

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71268: btrfs: fix reservation leak in some error paths when inserting inline extent (bsc#1259865).
• CVE-2025-71269: btrfs: do not free data reservation in fallback from inline due to -ENOSPC (bsc#1259889).
• CVE-2026-23030: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (bsc#1257561).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23136: libceph: reset sparse-read state in osd_fault() (bsc#1258303).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260562).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (bsc#1260799).
• CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation() (bsc#1260730).
• CVE-2026-23413: clsact: Fix use-after-free in init/destroy rollback asymmetry (bsc#1261498).
• CVE-2026-23414: tls: Purge async_hold in tls_decrypt_async_wait() (bsc#1261496).
• CVE-2026-31788: xen/privcmd: restrict usage in unprivileged domU (bsc#1259707).

The following non-security bugs were fixed:

• ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() (git-fixes).
• ACPI: OSI: Add DMI quirk for Acer Aspire One D255 (stable-fixes). -…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation() (bsc#1260730).

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260562).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation() (bsc#1260730).
• CVE-2026-23412: netfilter: bpf: defer hook memory release until rcu readers are done (bsc#1261412).
• CVE-2026-23413: clsact: Fix use-after-free in init/destroy rollback asymmetry (bsc#1261498).
• CVE-2026-31788: xen/privcmd: restrict usage in unprivileged domU (bsc#1259707).

The following non security issues were fixed:

• KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (bsc#1259461).
• KVM: x86/mmu: Retry fault before acquiring mmu_lock if mapping is changing (bsc#1253122).
• net: mana: fix use-after-free in add_adev() error path (git-fixes).
• net: mana: Trigger VF reset/recovery on health check failure due to HWC timeout (bsc#1259580).
• x86/platform/uv: Handle deconfigured sockets (bsc#1260347).
• xen/privcmd: unregister xenstore notifier on module exit (git-fixes).

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71268: btrfs: fix reservation leak in some error paths when inserting inline extent (bsc#1259865).
• CVE-2025-71269: btrfs: do not free data reservation in fallback from inline due to -ENOSPC (bsc#1259889).
• CVE-2026-23030: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (bsc#1257561).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23136: libceph: reset sparse-read state in osd_fault() (bsc#1258303).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: register hooks last when adding new chain/flowtable (bsc#1259188).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260562).
• CVE-2026-23319: bpf: export bpf_link_inc_not_zero (bsc#1260735).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (bsc#1260799).
• CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation() (bsc#1260730).
• CVE-2026-23413: clsact: Fix use-after-free in init/destroy rollback asymmetry (bsc#1261498).
• CVE-2026-23414: tls: Purge async_hold in tls_decrypt_async_wait() (bsc#1261496).
• CVE-2026-31788: xen/privcmd: restrict usage in unprivileged domU (bsc#1259707).

The following non security issues were fixed:

• accel/qaic: Handle DBC deactivation if the owner went away (git-fixes).
• ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() (git-fixes).
• ACPI: OSI: Add…

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2024-26584: net/tls: return ENOTSUPP on tls_init() (bsc#1220186).
• CVE-2025-38234: sched/rt: Fix race in push_rt_task (bsc#1246057).
• CVE-2025-39759: btrfs: qgroup: fix race between quota disable and quota rescan ioctl (bsc#1249522).
• CVE-2025-71268: btrfs: fix reservation leak in some error paths when inserting inline extent (bsc#1259865).
• CVE-2025-71269: btrfs: do not free data reservation in fallback from inline due to -ENOSPC (bsc#1259889).
• CVE-2026-22990: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (bsc#1257221).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set-nelems before insertion (bsc#1260009).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23318: ALSA: usb-audio: Use correct version for UAC3 header validation (bsc#1260536).
• CVE-2026-23362: can: bcm: fix locking for bcm_op runtime updates (bsc#1260489).
• CVE-2026-23382: HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them (bsc#1260551).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (bsc#1260799).
• CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation() (bsc#1260730).

The following non security issues were fixed:

• btrfs: fix processing of delayed data refs during backref walking (bsc#1228031).
• fs: skip superblock shrink on frozen xfs filesystems (bsc#1259770).

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-38542: RDMA/mana_ib: boundary check before installing cq callbacks (bsc#1226591).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (bsc#1253455).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71268: btrfs: fix reservation leak in some error paths when inserting inline extent (bsc#1259865).
• CVE-2025-71269: btrfs: do not free data reservation in fallback from inline due to -ENOSPC (bsc#1259889).
• CVE-2026-23030: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (bsc#1257561).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23088: tracing: Fix crash on synthetic stacktrace field usage (bsc#1257814).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23136: libceph: reset sparse-read state in osd_fault() (bsc#1258303).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO (bsc#1258286).
• CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (bsc#1258389).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260562).
• CVE-2026-23319: bpf:…

The SUSE Linux Enterprise Micro 6.0 and 6.1 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-38542: RDMA/mana_ib: boundary check before installing cq callbacks (bsc#1226591).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (bsc#1253455).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71268: btrfs: fix reservation leak in some error paths when inserting inline extent (bsc#1259865).
• CVE-2025-71269: btrfs: do not free data reservation in fallback from inline due to -ENOSPC (bsc#1259889).
• CVE-2026-23030: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (bsc#1257561).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23088: tracing: Fix crash on synthetic stacktrace field usage (bsc#1257814).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23136: libceph: reset sparse-read state in osd_fault() (bsc#1258303).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO (bsc#1258286).
• CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (bsc#1258389).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260562).
• CVE-2026-23319: bpf:…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
• CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
• CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets…

The SUSE Linux Micro (RT) 6.0 and 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2024-38542: RDMA/mana_ib: boundary check before installing cq callbacks (bsc#1226591).
• CVE-2025-39817: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (bsc#1249998).
• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40201: kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths (bsc#1253455).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71125: tracing: Do not register unsupported perf events (bsc#1256784).
• CVE-2025-71268: btrfs: fix reservation leak in some error paths when inserting inline extent (bsc#1259865).
• CVE-2025-71269: btrfs: do not free data reservation in fallback from inline due to -ENOSPC (bsc#1259889).
• CVE-2026-23030: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (bsc#1257561).
• CVE-2026-23047: libceph: make calc_target() set t->paused, not just clear it (bsc#1257682).
• CVE-2026-23069: vsock/virtio: fix potential underflow in virtio_transport_get_credit() (bsc#1257755).
• CVE-2026-23088: tracing: Fix crash on synthetic stacktrace field usage (bsc#1257814).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23136: libceph: reset sparse-read state in osd_fault() (bsc#1258303).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23154: net: fix segmentation of forwarding fraglist GRO (bsc#1258286).
• CVE-2026-23169: mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (bsc#1258389).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net/sched: cls_u32: use skb_header_pointer_careful() (bsc#1258340).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: register hooks last when adding new chain/flowtable (bsc#1259188).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260562).
• CVE-2026-23319: bpf: export…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
• CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-39998: scsi: target: target_core_configfs: Add length check to avoid buffer overflow (bsc#1252073).
• CVE-2025-40253: s390/ctcm: Fix double-kfree (bsc#1255084).
• CVE-2025-68794: iomap: adjust read range correctly for non-block-aligned positions (bsc#1256647).
• CVE-2025-71239: audit: add fchmodat2() to change attributes class (bsc#1259759).
• CVE-2026-23072: l2tp: Fix memleak in l2tp_udp_encap_recv() (bsc#1257708).
• CVE-2026-23103: ipvlan: Make the addrs_lock be per port (bsc#1257773).
• CVE-2026-23120: l2tp: avoid one data-race in l2tp_tunnel_del_work() (bsc#1258280).
• CVE-2026-23125: sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (bsc#1258293).
• CVE-2026-23138: kABI: Preserve values of the trace recursion bits (bsc#1258301).
• CVE-2026-23140: bpf, test_run: Subtract size of xdp_frame from allowed metadata size (bsc#1258305).
• CVE-2026-23187: pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (bsc#1258330).
• CVE-2026-23193: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (bsc#1258414).
• CVE-2026-23201: ceph: fix oops due to invalid pointer for kfree() in parse_longname() (bsc#1258337).
• CVE-2026-23204: net: add skb_header_pointer_careful() helper (bsc#1258340).
• CVE-2026-23215: x86/vmware: Fix hypercall clobbers (bsc#1258476).
• CVE-2026-23216: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (bsc#1258447).
• CVE-2026-23231: netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (bsc#1259188).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23242: RDMA/siw: Fix potential NULL pointer dereference in header processing (bsc#1259795).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259797).
• CVE-2026-23255: net: add proper RCU protection to /proc/net/ptype (bsc#1259891).
• CVE-2026-23262: gve: Fix stats report corruption on queue count change (bsc#1259870).
• CVE-2026-23270: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (bsc#1259886).
• CVE-2026-23272: netfilter: nf_tables: unconditionally bump set->nelems before insertion (bsc#1260009).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260005).
• CVE-2026-23277: net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (bsc#1259997).
• CVE-2026-23278: netfilter: nf_tables: always walk all pending catchall elements (bsc#1259998).
• CVE-2026-23281: wifi: libertas: fix use-after-free in lbs_free_adapter() (bsc#1260464).
• CVE-2026-23292: scsi: target: Fix recursive locking in __configfs_open_file() (bsc#1260500).
• CVE-2026-23293: net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260486).
• CVE-2026-23297: nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() (bsc#1260490).
• CVE-2026-23304: ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (bsc#1260544).
• CVE-2026-23319: bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (bsc#1260735).
• CVE-2026-23326: xsk: Fix fragment node deletion to prevent buffer leak (bsc#1260606).
• CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (bsc#1260550).
• CVE-2026-23343: xdp: produce a warning when calculated tailroom is negative (bsc#1260527).
• CVE-2026-23361: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (bsc#1260732).
• CVE-2026-23379: net/sched: ets: fix divide by zero in the offload path (bsc#1260481).
• CVE-2026-23381: net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (bsc#1260471).
• CVE-2026-23383: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (bsc#1260497).
• CVE-2026-23386: gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• SquashFS file system;
• UDF file system; -…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• S390 architecture;
• x86 architecture;
• Cryptographic API;
• ACPI drivers;
• ATM drivers;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• RNBD block device driver;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU idle management framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Power supply drivers;
• RapidIO drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• SCSI subsystem;
• Freescale SoC drivers;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Framebuffer layer;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• JFS file system;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• Proc file system;
• Pstore file system;
• SMB network file system;
• SquashFS file system;
• XFS file system;
• Audit subsystem;
• RAS (Reliability, Availability, Serviceability) subsystem;
• CPU frequency scaling framework;
• Memory Management;
• KVM subsystem;
• Memory management;
• Network traffic control;
• Netfilter;
• IP tunnels definitions;
• Tracing infrastructure;
• User-space API (UAPI);
• io_uring subsystem;
• BPF subsystem;
• Control group (cgroup);
• Kernel fork() syscall;
• Kernel futex primitives;
• Kernel kexec() syscall;
• Kernel module support;
• Scheduler…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• RNBD block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• MediaTek SoC drivers;
• Microchip PolarFire SoC system controller driver;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• MIPS architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• ATM drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• RNBD block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPIO subsystem;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Multifunction device drivers;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MOST (Media Oriented Systems Transport) drivers;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Performance monitor drivers;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Power supply drivers;
• RapidIO drivers;
• RAS (Reliability, Availability, Serviceability) subsystem;
• Remote Processor subsystem;
• RPMSG subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• MediaTek SoC drivers;
• Microchip PolarFire SoC system controller driver;
• Texas Instruments SoC drivers;
• SPI subsystem;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• ChipIdea USB driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare…

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Drivers core;
• Power management core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• Character device driver;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Counter interface drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DMA engine subsystem;
• EDAC drivers;
• EFI core;
• GPU drivers;
• Greybus drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• InfiniBand drivers;
• Input Device (Miscellaneous) drivers;
• IRQ chip drivers;
• LED subsystem;
• Mailbox framework;
• Multiple devices driver;
• Media drivers;
• MediaTek SMI driver;
• NVIDIA Tegra memory controller driver;
• Fastrpc Driver;
• IBM Advanced System Management driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Ethernet team driver;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• Pin controllers subsystem;
• x86 platform drivers;
• Broadcom BCM2835 power domain driver;
• Generic PM domains;
• i.MX PM domains;
• Remote Processor subsystem;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• Freescale SoC drivers;
• Microchip PolarFire SoC system controller driver;
• SPI subsystem;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• SM750 framebuffer staging driver;
• TCM subsystem;
• Thermal drivers;
• TTY drivers;
• UFS subsystem;
• Cadence USB3 driver;
• USB Device Class drivers;
• ULPI bus;
• USB core drivers;
• DesignWare USB2 driver;
• USB Gadget drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB YUREX driver;
• Renesas USBHS Controller drivers;
• USB Type-C Connector System Software Interface driver;
• VFIO drivers;
• Framebuffer layer;
• TSM TDX Guest driver;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FUSE (File system in Userspace);
• GFS2 file system;
• HFS+ file system;
• Journaling layer for block devices (JBD2);
• Network file systems library;
• Network…