CVE-2021-47670

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context

If a driver calls can_get_echo_skb() during a hardware IRQ (which is often, but not always, the case), the 'WARN_ON(in_irq)' in net/core/skbuff.c#skb_release_head_state() might be triggered, under network congestion circumstances, together with the potential risk of a NULL pointer dereference.

The root cause of this issue is the call to kfree_skb() instead of dev_kfree_skb_irq() in net/core/dev.c#enqueue_to_backlog().

This patch prevents the skb to be freed within the call to netif_rx() by incrementing its reference count with skb_get(). The skb is finally freed by one of the in-irq-context safe functions: dev_consume_skb_any() or dev_kfree_skb_any(). The "any" version is used because some drivers might call can_get_echo_skb() in a normal context.

The reason for this issue to occur is that initially, in the core network stack, loopback skb were not supposed to be received in hardware IRQ context. The CAN stack is an exeption.

This bug was previously reported back in 2017 in [1] but the proposed patch never got accepted.

While [1] directly modifies net/core/dev.c, we try to propose here a smoother modification local to CAN network stack (the assumption behind is that only CAN devices are affected by this issue).

[1] http://lore.kernel.org/r/[email protected](CVE-2020-36789)

In the Linux kernel, the following vulnerability has been resolved:

video: fbdev: cirrusfb: check pixclock to avoid divide by zero

Do a sanity check on pixclock value to avoid divide by zero.

If the pixclock value is zero, the cirrusfb driver will round up pixclock to get the derived frequency as close to maxclock as possible.

Syzkaller reported a divide error in cirrusfb_check_pixclock.

divide error: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2 RIP: 0010:cirrusfb_check_var+0x6f1/0x1260

Call Trace: fb_set_var+0x398/0xf90 do_fb_ioctl+0x4b8/0x6f0 fb_ioctl+0xeb/0x130 __x64_sys_ioctl+0x19d/0x220 do_syscall_64+0x3a/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae(CVE-2021-47641)

In the Linux kernel, the following vulnerability has been resolved:

can: dev: can_restart: fix use after free bug

After calling netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the netif_rx_ni() in: stats->rx_bytes += cf->len;

Reordering the lines solves the issue.(CVE-2021-47668)

In the Linux kernel, the following vulnerability has been resolved:

can: peak_usb: fix use after free bugs

After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_usb_netif_rx_ni().

Reordering the lines solves the issue.(CVE-2021-47670)

In the Linux kernel, the following vulnerability has been resolved:

qede: confirm skb is allocated before using

qede_build_skb() assumes build_skb() always works and goes straight to skb_reserve(). However, build_skb() can fail under memory pressure. This results in a kernel panic because the skb to reserve is NULL.

Add a check in case build_skb() failed to allocate and return NULL.

The NULL return is handled correctly in callers to qede_build_skb().(CVE-2022-49084)

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix leak of nested actions

While parsing user-provided actions, openvswitch module may dynamically allocate memory and store pointers in the internal copy of the actions. So this memory has to be freed while destroying the actions.

Currently there are only two such actions: ct() and set(). However, there are many actions that can hold nested lists…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

• kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

The kernel packages contain the Linux kernel, the core of any Linux operating system.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

• kernel: can: peak_usb: fix use…

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)

• kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning…

In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_usb_netif_rx_ni(). Reordering the lines solves the issue.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)
• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)
• kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670)
• kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)
• kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: padata: fix UAF in padata_reorder (CVE-2025-21727)
• kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)
• kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670)
• kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085)
• kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}
• nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
• nfsd: split sc_status out of sc_type {CVE-2024-50106}
• nfsd: avoid race after unhash_delegation_locked() {CVE-2024-50106}
• nfsd: don't call functions with side-effecting inside WARN_ON() {CVE-2024-50106}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• i2c/designware: Fix an initialization issue {CVE-2025-38380}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• mm/khugepaged: fix GUP-fast interaction by sending IPI {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• netfilter: xtables: avoid NFPROTO_UNSPEC where needed {CVE-2024-50038}
• netfilter: xtables: Add snapshot of hardidletimer target {CVE-2024-50038}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove {CVE-2025-22020}

• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50083}
• ext4: correct the misjudgment in ext4_iget_extra_inode {CVE-2022-50083}
• ext4: correct max_inline_xattr_value_size computing {CVE-2022-50083}
• ext4: fix use-after-free in ext4_xattr_set_entry {CVE-2022-50083}
• ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h {CVE-2022-50083}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• mptcp: do not queue data on closed subflows {CVE-2022-50070}
• mptcp: export mptcp_subflow_active {CVE-2022-50070}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• ice: xsk: prohibit usage of non-balanced queue id {CVE-2022-50003}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• virtio-gpu: fix a missing check to avoid NULL dereference {CVE-2022-50181}
• usb: xhci_plat_remove: avoid NULL dereference {CVE-2022-50133}
• ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot {CVE-2022-50015}
• netfilter: nft_tproxy: restrict to prerouting hook {CVE-2022-50001}
• scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq {CVE-2022-49986}
• ath11k: fix netdev open race {CVE-2022-50187}

• inet: fully convert sk->sk_rx_dst to RCU rules {CVE-2021-47103}
• ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
• posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
• can: peak_usb: fix use after free bugs {CVE-2021-47670}
• wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
• RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127}
• i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
• udp: Fix memory accounting leak. {CVE-2025-22058}
• ALSA: bcd2000: Fix a UAF bug on the error path of probing {CVE-2022-50083}
• ext4: correct the misjudgment in ext4_iget_extra_inode {CVE-2022-50083}
• ext4: correct max_inline_xattr_value_size computing {CVE-2022-50083}
• ext4: fix use-after-free in ext4_xattr_set_entry {CVE-2022-50083}
• ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h {CVE-2022-50083}
• Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
• net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085}
• mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
• padata: fix UAF in padata_reorder {CVE-2025-21727}
• net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
• codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
• sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
• sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
• sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
• sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
• sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
• mptcp: do not queue data on closed subflows {CVE-2022-50070}
• mptcp: export mptcp_subflow_active {CVE-2022-50070}
• net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477}
• tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
• scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
• crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
• ext4: avoid resizing to a partial cluster size {CVE-2022-50020}
• net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
• net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
• ice: xsk: prohibit usage of non-balanced queue id {CVE-2022-50003}
• net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
• virtio-gpu: fix a missing check to avoid NULL dereference {CVE-2022-50181}
• usb: xhci_plat_remove: avoid NULL dereference {CVE-2022-50133}
• ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot {CVE-2022-50015}
• netfilter: nft_tproxy: restrict to prerouting hook {CVE-2022-50001}
• scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq {CVE-2022-49986}
• ath11k: fix netdev open race {CVE-2022-50187}

• CVE-2022-49416
  • wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• CVE-2022-49685
  • iio: trigger: sysfs: fix use-after-free on remove {CVE-2022-49685}
• CVE-2021-47670
  • can: peak_usb: fix use after free bugs {CVE-2021-47670}
• CVE-2026-98706
  • wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
• CVE-2026-98610
  • net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
• CVE-2026-98548
  • sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
• CVE-2026-98614
  • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• CVE-2026-98547
  • af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
• CVE-2026-98579
  • nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure {CVE-2026-98579}
• CVE-2026-98581
  • nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() {CVE-2026-98581}
• CVE-2026-98577
  • nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
• CVE-2026-98482
  • nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
• CVE-2026-98576
  • nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
• CVE-2026-98624
  • netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
  • netlink: use blocking notifier {CVE-2026-98624}
• CVE-2026-98794
  • ipvs: filter some flags received in the backup server {CVE-2026-98794}
• CVE-2026-98829
  • wifi: mac80211: drop oversized fragments to avoid extra_len overflow {CVE-2026-98829}
• CVE-2026-98708
  • wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708}
• CVE-2026-98707
  • wifi: mac80211: shut down RX BA session timer on teardown {CVE-2026-98707}
• CVE-2026-98532
  • ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
• CVE-2026-98541
  • fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
• CVE-2026-98461
  • Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461}
• CVE-2026-98621
  • net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
• CVE-2026-98526
  • llc: reserve device headroom for allocated frames {CVE-2026-98526}
• CVE-2026-98555
  • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
• CVE-2026-98573
  • net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
• CVE-2026-98739
  • Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}
• CVE-2026-98457
  • Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
• CVE-2026-98460
  • Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
• CVE-2026-98856
  • kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856}
• CVE-2026-98636
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
• CVE-2026-98681
  • smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681}
• CVE-2026-98771
  • usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
• CVE-2026-98772
  • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
• CVE-2026-98696
  • USB: serial: fix driver deregistration order {CVE-2026-98696}
• CVE-2026-98697
  • USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
• CVE-2026-98769
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
• CVE-2026-98764
  • usb: gadget: f_fs: Fix NULL pointer dereference in …

The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2022-49111: Bluetooth: Fix use after free in hci_send_acl (bsc#1237984).
• CVE-2025-21726: padata: avoid UAF for reorder_work (bsc#1238865).
• CVE-2025-21785: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (bsc#1238747).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1238512).
• CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
• CVE-2025-22020: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (bsc#1241280).
• CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47670: can: peak_usb: fix use after free bugs (bsc#1241407).
• CVE-2022-49139: Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt (bsc#1238032).
• CVE-2022-49145: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data (bsc#1238162).
• CVE-2022-49168: btrfs: do not clean up repair bio if submit fails (bsc#1238109).
• CVE-2022-49190: kernel/resource: fix kfree() of bootmem memory again (bsc#1238130).
• CVE-2022-49212: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init (bsc#1238331).
• CVE-2022-49216: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe (bsc#1238338).
• CVE-2022-49235: ath9k_htc: fix uninit value bugs (bsc#1238333).
• CVE-2022-49248: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction (bsc#1238284).
• CVE-2022-49253: media: usb: go7007: s2250-board: fix leak in probe() (bsc#1238420).
• CVE-2022-49320: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type (bsc#1238394).
• CVE-2022-49326: rtl818x: Prevent using not initialized queues (bsc#1238646).
• CVE-2022-49371: driver core: fix deadlock in __device_attach (bsc#1238546).
• CVE-2022-49382: soc: rockchip: Fix refcount leak in rockchip_grf_init (bsc#1238306).
• CVE-2022-49396: phy: qcom-qmp: fix reset-controller leak on probe errors (bsc#1238289).
• CVE-2022-49420: net: annotate races around sk->sk_bound_dev_if (bsc#1238887).
• CVE-2022-49441: tty: fix deadlock caused by calling printk() under tty_port->lock (bsc#1238263).
• CVE-2022-49445: pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() (bsc#1238019).
• CVE-2022-49460: PM / devfreq: rk3399_dmc: Disable edev on remove() (bsc#1238892).
• CVE-2022-49467: drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() (bsc#1238815).
• CVE-2022-49474: Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout (bsc#1238071).
• CVE-2022-49491: drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() (bsc#1238539).
• CVE-2022-49503: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix (bsc#1238868).
• CVE-2022-49592: net: stmmac: fix dma queue left shift overflow issue (bsc#1238311).
• CVE-2022-49625: sfc: fix kernel panic when creating VF (bsc#1238411).
• CVE-2022-49635: drm/i915/selftests: fix subtraction overflow bug (bsc#1238806).
• CVE-2022-49652: dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate (bsc#1238871).
• CVE-2022-49715: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions (bsc#1238818).
• CVE-2022-49728: kABI workaround for changeing the variable length type to size_t (bsc#1239111).
• CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred (bsc#1239060).
• CVE-2022-49751: w1: fix WARNING after calling w1_process() (bsc#1240254).
• CVE-2022-49761: btrfs: always report error in run_one_delayed_ref() (bsc#1240261).
• CVE-2022-49772: ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() (bsc#1242147).
• CVE-2022-49775: tcp: cdg: allow tcp_cdg_release() to be called multiple times (bsc#1242245).
• CVE-2022-49776: macvlan: enforce a consistent minimal mtu (bsc#1242248).
• CVE-2022-49787: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() (bsc#1242352).
• CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (bsc#1242353).
• CVE-2022-49813: net: ena: Fix error handling in ena_init() (bsc#1242497).
• CVE-2022-49821: mISDN: fix possible memory leak in mISDN_dsp_element_register() (bsc#1242542).
• CVE-2022-49826: ata: libata-transport: fix double ata_host_put() in ata_tport_add() (bsc#1242549).
• CVE-2022-49829: drm/scheduler: fix fence ref counting (bsc#1242691).
• CVE-2022-49832: pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map (bsc#1242154).
• CVE-2022-49835: ALSA: hda: fix potential memleak in…

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2025-21726: padata: avoid UAF for reorder_work (bsc#1238865).
• CVE-2025-21785: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (bsc#1238747).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1238512).
• CVE-2025-22004: net: atm: fix use after free in lec_send() (bsc#1240835).
• CVE-2025-22020: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (bsc#1241280).
• CVE-2025-22055: net: fix geneve_opt length integer overflow (bsc#1241371).