CVE-2025-40233

ocfs2: clear extent cache after moving/defragmenting extents

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: clear extent cache after moving/defragmenting extents

The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:

copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
ioctl(FITRIM) triggers ocfs2_move_extents()
__ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
The extent map cache is not invalidated after the move
Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.15%Up 0.1 points since Dec 5, 2025

What each source reports

CVE List Score used 7.8

ocfs2: clear extent cache after moving/defragmenting extents

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: clear extent cache after moving/defragmenting extents

The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:

copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
ioctl(FITRIM) triggers ocfs2_move_extents()
__ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
The extent map cache is not invalidated after the move
Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.

Record: CVE-2025-40233
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2025-201226 7.8

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: clear extent cache after moving/defragmenting extents

The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:

copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
ioctl(FITRIM) triggers ocfs2_move_extents()
__ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
The extent map cache is not invalidated after the move
Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.

Record: EUVD-2025-201226
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pmpf-32ww-gfmp 7.8

In the Linux kernel, the following vulnerability has been resolved: ocfs2: clear extent cache...

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: clear extent cache after moving/defragmenting extents

The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:

copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
ioctl(FITRIM) triggers ocfs2_move_extents()
__ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
The extent map cache is not invalidated after the move
Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.

Record: GHSA-pmpf-32ww-gfmp
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: clear extent cache after moving/defragmenting extents

The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:

copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
ioctl(FITRIM) triggers ocfs2_move_extents()
__ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
The extent map cache is not invalidated after the move
Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.

Record: CVE-2025-40233
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2025-40233 7.8

Record: BELL-CVE-2025-40233
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

ocfs2: clear extent cache after moving/defragmenting extents

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: clear extent cache after moving/defragmenting extents

The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:

copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
ioctl(FITRIM) triggers ocfs2_move_extents()
__ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
The extent map cache is not invalidated after the move
Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.

Record: CVE-2025-40233
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 47 moreShow less

OSVDEBIAN-CVE-2025-40233 7.8

In the Linux kernel, the following vulnerability has been resolved: ocfs2: clear extent cache after moving/defragmenting extents The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters(). The problem occurs when: 1. copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED 2. ioctl(FITRIM) triggers ocfs2_move_extents() 3. __ocfs2_move_extents_range() reads and caches the extent (flags=0x2) 4. ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0) 5. The extent map cache is not invalidated after the move 6. Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch 7. BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.

Record: DEBIAN-CVE-2025-40233
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2026-4591 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: clear extent cache after moving/defragmenting extents

The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters().

The problem occurs when:

copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED
ioctl(FITRIM) triggers ocfs2_move_extents()
__ocfs2_move_extents_range() reads and caches the extent (flags=0x2)
ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0)
The extent map cache is not invalidated after the move
Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch
BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers

Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk.(CVE-2025-40233)

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: properly keep track of conduit reference

Problem description

DSA has a mumbo-jumbo of reference handling of the conduit net device and its kobject which, sadly, is just wrong and doesn't make sense.

There are two distinct problems.

The OF path, which uses of_find_net_device_by_node(), never releases the elevated refcount on the conduit's kobject. Nominally, the OF and non-OF paths should result in objects having identical reference counts taken, and it is already suspicious that dsa_dev_to_net_device() has a put_device() call which is missing in dsa_port_parse_of(), but we can actually even verify that an issue exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command "before" and "after" applying this patch:

(unbind the conduit driver for net device eno2) echo 0000:00:00.2 > /sys/bus/pci/drivers/fsl_enetc/unbind

we see these lines in the output diff which appear only with the patch applied:

kobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000) kobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)

After we find the conduit interface one way (OF) or another (non-OF), it can get unregistered at any time, and DSA remains with a long-lived, but in this case stale, cpu_dp->conduit pointer. Holding the net device's underlying kobject isn't actually of much help, it just prevents it from being freed (but we never need that kobject directly). What helps us to prevent the net device from being unregistered is the parallel netdev reference mechanism (dev_hold() and dev_put()).

Actually we actually use that netdev tracker mechanism implicitly on user ports since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), via netdev_upper_dev_link(). But time still passes at DSA switch probe time between the initial of_find_net_device_by_node() code and the user port creation time, time during which the conduit could unregister itself and DSA wouldn't know about it.

So we have to run of_find_net_device_by_node() under rtnl_lock() to prevent that from happening, and release the lock only with the netdev tracker having acquired the reference.

Do we need to keep the reference until dsa_unregister_switch() / dsa_switch_shutdown()? 1: Maybe yes. A switch device will still be registered even if all user ports failed to probe, see commit 86f8b1c01a0a ("net: dsa: Do not make user port errors fatal"), and the cpu_dp->conduit pointers remain valid. I haven't audited all call paths to see…

Record: OESA-2026-4591
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-40233 6.8

Record: UBUNTU-CVE-2025-40233
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVCLSA-2026-1789460387 No score

Fix of 134 CVEs

CVE-2026-72463
- xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
CVE-2026-64600
- xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
CVE-2026-46175
- f2fs: fix fsck inconsistency caused by FGGC of node block {CVE-2026-46175}
CVE-2025-68254
- staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing {CVE-2025-68254}
CVE-2025-68255
- staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing {CVE-2025-68255}
CVE-2026-64268
- RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
CVE-2025-68286
- drm/amd/display: Check NULL before accessing {CVE-2025-68286}
CVE-2026-53024
- greybus: raw: fix use-after-free if write is called after disconnect {CVE-2026-53024}
CVE-2026-53025
- greybus: raw: fix use-after-free on cdev close {CVE-2026-53025}
CVE-2026-52934
- batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
CVE-2025-68303
- platform/x86: intel: punit_ipc: fix memory corruption {CVE-2025-68303}
CVE-2026-64280
- fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280}
CVE-2026-64188
- net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
CVE-2026-64109
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
CVE-2026-64274
- Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
CVE-2026-64270
- Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
CVE-2026-64093
- batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
CVE-2026-64091
- batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
CVE-2026-53329
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}
CVE-2026-64298
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
CVE-2026-64276
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
CVE-2026-64273
- Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
CVE-2026-64271
- Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
CVE-2026-64266
- fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
CVE-2026-64191
- i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
CVE-2026-64189
- netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
CVE-2026-31786
- Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
CVE-2025-68799
- caif: fix integer underflow in cffrml_receive() {CVE-2025-68799}
CVE-2025-68302
- net: sxgbe: fix potential NULL dereference in sxgbe_rx() {CVE-2025-68302}
CVE-2025-40243
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() {CVE-2025-40243}
CVE-2025-40233
- ocfs2: clear extent cache after moving/defragmenting extents {CVE-2025-40233}
CVE-2026-23269
- apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
CVE-2026-43249
- 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
CVE-2026-31657
- batman-adv: hold claim backbone gateways by reference {CVE-2026-31657}
CVE-2026-31598
- ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
CVE-2026-31768
- iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
CVE-2026-23216
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} *…

Record: CLSA-2026-1789460387
Updated: 2026-11-02

OSVopenSUSE-SU-2026:20145-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40330: bnxt_en: Shutdown FW…

Record: openSUSE-SU-2026:20145-1
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2025-40233 No score

CVE-2025-40233 in linux - Patched by Root

Root has patched CVE-2025-40233 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2025-40233
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2404-CVE-2025-40233 No score

CVE-2025-40233 in linux - Patched by Root

Root has patched CVE-2025-40233 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-40233
Updated: 2026-11-02

OSVSUSE-SU-2026:0263-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
RDMA/hns: Fix the modification of max_send_sge (git-fixes).
RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
cpuidle: Move IRQ state validation (git-fixes).
cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
dm: free table mempools if not used in __bind (git-fixes).
padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()…

Record: SUSE-SU-2026:0263-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0278-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

Record: SUSE-SU-2026:0278-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0281-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 Azure kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

Record: SUSE-SU-2026:0281-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0293-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
CVE-2025-68259: KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced (bsc#1255199).

The following non security issues were fixed:

ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4 (git-fixes).
ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint() (git-fixes).
ALSA: dice: fix buffer overflow in detect_stream_formats() (git-fixes).
ALSA: firewire-motu: add bounds check in put_user loop for DSP events (git-fixes).
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (git-fixes).
ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (git-fixes).
ALSA: uapi: Fix typo in asound.h comment (git-fixes).
ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (stable-fixes).
ASoC: Intel: catpt: Fix error path in hw_params() (git-fixes).
ASoC: ak4458: Disable regulator when error happens (git-fixes).
ASoC: ak5558: Disable regulator when error happens (git-fixes).
ASoC: codecs: wcd938x: fix OF node leaks on probe failure (git-fixes).
ASoC: fsl_xcvr: clear the channel status control memory (git-fixes).
ASoC: qcom: q6adm: the the copp device only during last instance (git-fixes).
ASoC: qcom: q6asm-dai: perform correct state check before closing (git-fixes).
ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment…

Record: SUSE-SU-2026:0293-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0315-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40287: exfat: fix improper check of dentry.stream.valid_size (bsc#1255030).
CVE-2025-40289: drm/amdgpu: hide VRAM sysfs attributes on GPUs without VRAM (bsc#1255042).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187). -…

Record: SUSE-SU-2026:0315-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0316-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-49604,CVE-2025-40074: ip: Fix data-races around sysctl_ip_fwd_use_pmtu (bsc#1238414 bsc#1252794).
CVE-2022-50527: drm/amdgpu: Fix size validation for non-exclusive domains (v4) (bsc#1251738).
CVE-2022-50625: serial: amba-pl011: avoid SBSA UART accessing DMACR register (bsc#1254559).
CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
CVE-2022-50656: nfc: pn533: Clear nfc_target before being used (bsc#1254745).
CVE-2022-50678: wifi: brcmfmac: fix invalid address access when enabling SCAN log level (bsc#1254902).
CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
CVE-2023-53454: HID: multitouch: Correct devm device reference for hidinput input_dev name (bsc#1250759).
CVE-2023-53718: ring-buffer: Do not swap cpu_buffer during resize process (bsc#1252564).
CVE-2023-53748: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup (bsc#1254907).
CVE-2023-53765: dm cache: free background tracker's queued work in btracker_destroy (bsc#1254912).
CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
CVE-2023-53788: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() (bsc#1254917).
CVE-2023-53819: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va (bsc#1254712).
CVE-2023-53850: iavf: use internal state to free traffic IRQs (bsc#1254677).
CVE-2023-54120: Bluetooth: Fix race condition in hidp_session_thread (bsc#1256133).
CVE-2023-54214: Bluetooth: L2CAP: Fix potential user-after-free (bsc#1255954).
CVE-2023-54236: net/net_failover: fix txq exceeding warning (bsc#1255922).
CVE-2023-54286: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace (bsc#1255803).
CVE-2023-54300: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (bsc#1255790).
CVE-2025-38085: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (bsc#1245431 bsc#1245499).
CVE-2025-38336: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330 (bsc#1246370).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40035: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak (bsc#1252866).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40064: smc: Fix use-after-free in __pnet_find_base_ndev() (bsc#1252845).
CVE-2025-40075: tcp_metrics: use dst_dev_net_rcu() (bsc#1252795).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40110: drm/vmwgfx: Fix a null-ptr access in the cursor snooper (bsc#1253275).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
CVE-2025-40149: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (bsc#1253355).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40164: usbnet: Fix using smp_processor_id() in preemptible code warnings (bsc#1253407).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40168: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (bsc#1253427).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40198: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (bsc#1253453). -…

Record: SUSE-SU-2026:0316-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0317-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).

The following non security issues were fixed:

ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes).
ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes).
ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes).
ACPI: property: Fix buffer properties extraction for subnodes (git-fixes).
KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes).
RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes).
RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes).
RDMA/hns: Fix the modification of max_send_sge (git-fixes).
RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes).
RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes).
RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes).
RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes).
RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes).
RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes).
RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes).
RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes).
arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes).
cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes).
cpuidle: Move IRQ state validation (git-fixes).
cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes).
dm: free table mempools if not used in __bind (git-fixes).
padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563).
platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes).
x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes).
x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes).
x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes).
x86/tdx: Drop flags from __tdx_hypercall() (git-fixes).
x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes).
x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes).
x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes).
x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed()…

Record: SUSE-SU-2026:0317-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0350-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50282: chardev: fix error handling in cdev_device_add() (bsc#1249739).
CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
CVE-2022-50717: nvmet-tcp: add bounds check on Transfer Tag (bsc#1255844).
CVE-2022-50726: net/mlx5: Fix possible use-after-free in async command interface (bsc#1256040).
CVE-2022-50736: RDMA/siw: Fix immediate work request flush to completion queue (bsc#1256137).
CVE-2022-50756: nvme-core: replace ctrl page size with a macro (bsc#1256216).
CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
CVE-2023-53761: USB: usbtmc: Fix direction for 0-length ioctl control messages (bsc#1255002).
CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
CVE-2023-54168: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() (bsc#1256053).
CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).

Record: SUSE-SU-2026:0350-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0369-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50282: chardev: fix error handling in cdev_device_add() (bsc#1249739).
CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
CVE-2022-50717: nvmet-tcp: add bounds check on Transfer Tag (bsc#1255844).
CVE-2022-50726: net/mlx5: Fix possible use-after-free in async command interface (bsc#1256040).
CVE-2022-50736: RDMA/siw: Fix immediate work request flush to completion queue (bsc#1256137).
CVE-2022-50756: nvme-core: replace ctrl page size with a macro (bsc#1256216).
CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
CVE-2023-53761: USB: usbtmc: Fix direction for 0-length ioctl control messages (bsc#1255002).
CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
CVE-2023-54168: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() (bsc#1256053).
CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).

Record: SUSE-SU-2026:0369-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0411-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
CVE-2024-28956: x86/its: Enumerate Indirect Target Selection (ITS) bug (bsc#1242006).
CVE-2024-36348: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
CVE-2024-36349: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
CVE-2024-36350: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
CVE-2024-36357: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
CVE-2025-38129: page_pool: fix inconsistency for page_pool_ring_lock() (bsc#1245723).
CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40300: Documentation/hw-vuln: Add VMSCAPE documentation (bsc#1247483).
CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
CVE-2025-68183: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (bsc#1255251).
CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).
CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582).
CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).
CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).

The following non security issues were fixed:

x86/CPU/AMD: Add ZenX generations flags (bsc#1238896).
x86: make page fault handling disable interrupts properly (git-fixes).

Record: SUSE-SU-2026:0411-1
Updated: 2026-11-02

OSVSUSE-SU-2026:0617-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785).
CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594).
CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576).
CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397).
CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871).
CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751).
CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095).
CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908).
CVE-2024-28956: x86/its: Enumerate Indirect Target Selection (ITS) bug (bsc#1242006).
CVE-2024-36348: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
CVE-2024-36349: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
CVE-2024-36350: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
CVE-2024-36357: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896).
CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).
CVE-2024-46854: net: dpaa: Pad packets to ETH_ZLEN (bsc#1231084).
CVE-2025-21738: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (bsc#1238917).
CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210).
CVE-2025-38129: page_pool: fix inconsistency for page_pool_ring_lock() (bsc#1245723).
CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751).
CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678).
CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40300: Documentation/hw-vuln: Add VMSCAPE documentation (bsc#1247483).
CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615).
CVE-2025-68183: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (bsc#1255251).
CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377).
CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401).
CVE-2025-68312: usbnet: Prevents free active kevent (bsc#1255171).
CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688).
CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641).
CVE-2025-71085: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (bsc#1256623).
CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612).
CVE-2025-71112: net: hns3: add VLAN id validation before using (bsc#1256726).
CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744).
CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779).
CVE-2026-22999: net/sched: sch_qfq: do not free…

Record: SUSE-SU-2026:0617-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20207-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40330: bnxt_en: Shutdown FW…

Record: SUSE-SU-2026:20207-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20220-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40330: bnxt_en: Shutdown FW…

Record: SUSE-SU-2026:20220-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20228-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40330: bnxt_en: Shutdown FW…

Record: SUSE-SU-2026:20228-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20477-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in…

Record: SUSE-SU-2026:20477-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20498-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2023-54013: interconnect: Fix locking for runpm vs reclaim (bsc#1256280).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40259: scsi: sg: Do not sleep in atomic context (bsc#1254845).
CVE-2025-40261: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (bsc#1254839).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in…

Record: SUSE-SU-2026:20498-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20564-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

CVE-2025-38704: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer (bsc#1254408).
CVE-2025-39880: ceph: fix race condition validating r_parent before applying state (bsc#1250388).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40130: scsi: ufs: core: Fix data race in CPU latency PM QoS request handling
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40214: af_unix: Initialise scc_index in unix_add_edge() (bsc#1254961).
CVE-2025-40215: xfrm: delete x->tunnel as we delete x (bsc#1254959).
CVE-2025-40218: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success (bsc#1254964).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40237: fs/notify: call exportfs_encode_fid with s_umount (bsc#1254809).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40239: net: phy: micrel: always set shared->phydev for LAN8814 (bsc#1254868).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40246: xfs: fix out of bounds memory read error in symlink repair (bsc#1254861).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40255: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() (bsc#1255156).
CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843).
CVE-2025-40264: be2net: pass wrb_params in case of OS2BMC (bsc#1254835).
CVE-2025-40268: cifs: client: fix memory leak in smb3_fs_context_parse_param (bsc#1255082).
CVE-2025-40271: fs/proc: fix uaf in proc_readdir_de() (bsc#1255297).
CVE-2025-40274: KVM: guest_memfd: Remove bindings on memslot deletion when gmem is dying (bsc#1254830).
CVE-2025-40276: drm/panthor: Flush shmem writes before mapping buffers CPU-uncached (bsc#1254824).
CVE-2025-40278: net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak (bsc#1254825).
CVE-2025-40279: net: sched: act_connmark: initialize struct tc_ife to fix kernel leak (bsc#1254846).
CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847).
CVE-2025-40292: virtio-net: fix received length check in big packets (bsc#1255175).
CVE-2025-40293: iommufd: Don't overflow during division for dirty tracking (bsc#1255179).
CVE-2025-40297: net: bridge: fix use-after-free due to MST port state bypass (bsc#1255187).
CVE-2025-40319: bpf: Sync pending IRQ work before freeing ring buffer (bsc#1254794).
CVE-2025-40328: smb: client: fix potential UAF in smb2_close_cached_fid() (bsc#1254624).
CVE-2025-40330: bnxt_en: Shutdown FW…

Record: SUSE-SU-2026:20564-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20845-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Record: SUSE-SU-2026:20845-1
Updated: 2026-11-02

OSVSUSE-SU-2026:20876-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and 6.1 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

CVE-2023-53817: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() (bsc#1254992).
CVE-2025-37861: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (bsc#1243055).
CVE-2025-38321: smb: Log an error when close_all_cached_dirs fails (bsc#1246328).
CVE-2025-38728: smb3: fix for slab out of bounds on mount to ksmbd (bsc#1249256).
CVE-2025-39748: bpf: Forget ranges when refining tnum after JSET (bsc#1249587).
CVE-2025-39880: libceph: fix invalid accesses to ceph_connection_v1_info (bsc#1250388).
CVE-2025-39890: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event (bsc#1250334).
CVE-2025-39964: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (bsc#1251966).
CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046).
CVE-2025-40006: mm/hugetlb: fix folio is still mapped when deleted (bsc#1252342).
CVE-2025-40024: vhost: Take a reference on the task in struct vhost_task (bsc#1252686).
CVE-2025-40033: remoteproc: pru: Fix potential NULL pointer dereference in pru_rproc_set_ctable() (bsc#1252824).
CVE-2025-40042: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference (bsc#1252861).
CVE-2025-40053: net: dlink: handle copy_thresh allocation failure (bsc#1252808).
CVE-2025-40081: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() (bsc#1252776).
CVE-2025-40099: cifs: parse_dfs_referrals: prevent oob on malformed input (bsc#1252911).
CVE-2025-40102: KVM: arm64: Prevent access to vCPU events before init (bsc#1252919).
CVE-2025-40103: smb: client: Fix refcount leak for cifs_sb_tlink (bsc#1252924).
CVE-2025-40123: bpf: Enforce expected_attach_type for tailcall compatibility (bsc#1253365).
CVE-2025-40134: dm: fix NULL pointer dereference in __dm_suspend() (bsc#1253386).
CVE-2025-40135: ipv6: use RCU in ip6_xmit() (bsc#1253342).
CVE-2025-40153: mm: hugetlb: avoid soft lockup when mprotect to large memory area (bsc#1253408).
CVE-2025-40158: ipv6: use RCU in ip6_output() (bsc#1253402).
CVE-2025-40160: xen/events: Cleanup find_virq() return codes (bsc#1253400).
CVE-2025-40167: ext4: detect invalid INLINE_DATA + EXTENTS flag combination (bsc#1253458).
CVE-2025-40170: net: use dst_dev_rcu() in sk_setup_caps() (bsc#1253413).
CVE-2025-40178: pid: Add a judgment for ns null in pid_nr_ns (bsc#1253463).
CVE-2025-40179: ext4: verify orphan file size is not too big (bsc#1253442).
CVE-2025-40187: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (bsc#1253647).
CVE-2025-40190: ext4: guard against EA inode refcount underflow in xattr update (bsc#1253623).
CVE-2025-40192: Revert "ipmi: fix msg stack when IPMI is disconnected" (bsc#1253622).
CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520).
CVE-2025-40231: vsock: fix lock inversion in vsock_assign_transport() (bsc#1254815).
CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813).
CVE-2025-40238: net/mlx5: Fix IPsec cleanup over MPV device (bsc#1254871).
CVE-2025-40240: sctp: avoid NULL dereference when chunk data buffer is missing (bsc#1254869).
CVE-2025-40242: gfs2: Fix unlikely race in gdlm_put_lock (bsc#1255075).
CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established (bsc#1254864).
CVE-2025-40250: net/mlx5: Clean up only new IRQ glue on request_irq() failure (bsc#1254854).
CVE-2025-40251: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (bsc#1254856).
CVE-2025-40252: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() (bsc#1254849).
CVE-2025-40254: net: openvswitch: remove never-working support for setting nsh fields (bsc#1254852).
CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer()…

Record: SUSE-SU-2026:20876-1
Updated: 2026-11-02

OSVUSN-8029-1 No score

linux, linux-raspi, linux-realtime vulnerabilities