CVE-2025-54518

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)

Bug Fix(es) and Enhancement(s):

• Kernel crash in bpf_for_each_array_elem() due to missing backport of upstream commit 4b6313cf99b0 (JIRA:Rocky Linux-191844)

• gfs2: xfstests generic/363 failure [rhel-8.10.z] (JIRA:Rocky Linux-214099)

• Rocky Linux8: HYPERV hv_storvsc driver can we add additional code to allow PERSISTENT_RESERVE_IN [Rocky Linux 8.10Z] (JIRA:Rocky Linux-188270)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)

Bug Fix(es) and Enhancement(s):

• Kernel crash in bpf_for_each_array_elem() due to missing backport of upstream commit 4b6313cf99b0 (JIRA:Rocky Linux-191844)

• gfs2: xfstests generic/363 failure [rhel-8.10.z] (JIRA:Rocky Linux-214099)

• Rocky Linux8: HYPERV hv_storvsc driver can we add additional code to allow PERSISTENT_RESERVE_IN [Rocky Linux 8.10Z] (JIRA:Rocky Linux-188270)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)

• kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)

• kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368)

• kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)

Bug Fix(es) and Enhancement(s):

• Kernel oops after increasing max number of mac addresses of a mlx5 VF [rhel-9.8.z] (JIRA:Rocky Linux-213036)

• Rocky Linux9.4 - s390/pkey: Check length in pkey_pckmo handler implementation [rhel-9.8.z] (JIRA:Rocky Linux-215578)

• Rocky Linux9.4 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [rhel-9.8.z] (JIRA:Rocky Linux-215580)

• cifs: periodic IO errors when rename races with lease break (JIRA:Rocky Linux-192999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)

Bug Fix(es) and Enhancement(s):

• Kernel crash in bpf_for_each_array_elem() due to missing backport of upstream commit 4b6313cf99b0 (JIRA:Rocky Linux SIG Cloud-191844)

• gfs2: xfstests generic/363 failure [rhel-8.10.z] (JIRA:Rocky Linux SIG Cloud-214099)

• Rocky Linux SIG Cloud8: HYPERV hv_storvsc driver can we add additional code to allow PERSISTENT_RESERVE_IN [Rocky Linux SIG Cloud 8.10Z] (JIRA:Rocky Linux SIG Cloud-188270)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)

Bug Fix(es) and Enhancement(s):

• Kernel crash in bpf_for_each_array_elem() due to missing backport of upstream commit 4b6313cf99b0 (JIRA:AlmaLinux-191844)
• gfs2: xfstests generic/363 failure [almalinux-8.10.z] (JIRA:AlmaLinux-214099)
• AlmaLinux8: HYPERV hv_storvsc driver can we add additional code to allow PERSISTENT_RESERVE_IN [AlmaLinux 8.10Z] (JIRA:AlmaLinux-188270)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)

Bug Fix(es) and Enhancement(s):

• Kernel crash in bpf_for_each_array_elem() due to missing backport of upstream commit 4b6313cf99b0 (JIRA:AlmaLinux-191844)
• gfs2: xfstests generic/363 failure [almalinux-8.10.z] (JIRA:AlmaLinux-214099)
• AlmaLinux8: HYPERV hv_storvsc driver can we add additional code to allow PERSISTENT_RESERVE_IN [AlmaLinux 8.10Z] (JIRA:AlmaLinux-188270)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530)
• kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518)
• kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368)
• kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531)

Bug Fix(es) and Enhancement(s):

• Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-9.8.z] (JIRA:AlmaLinux-213036)
• AlmaLinux9.4 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-9.8.z] (JIRA:AlmaLinux-215578)
• AlmaLinux9.4 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-9.8.z] (JIRA:AlmaLinux-215580)
• cifs: periodic IO errors when rename races with lease break (JIRA:AlmaLinux-192999)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds {CVE-2023-53582}
• net/sched: accept TCA_STAB only for root qdisc {CVE-2024-50039}
• bpf, sockmap: Several fixes to bpf_msg_pop_data {CVE-2024-56720}
• net: add more sanity checks to qdisc_pkt_len_init() {CVE-2024-49948}
• nvme-tcp: sanitize request list handling {CVE-2025-38264}
• smb: client: fix double free of TCP_Server_Info::hostname {CVE-2025-21673}
• net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
• net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
• Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
• bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
• libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
• nfsd: never defer requests during idmap lookup {CVE-2026-45983}
• openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
• thermal: core: Fix thermal zone governor cleanup issues {CVE-2026-46021}
• tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
• USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
• netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
• Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• smb: client: fix krb5 mount with username option {CVE-2026-31392}
• netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212}
• USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
• crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016}
• netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
• fuse: reject fuse_notify() pagecache ops on directories {CVE-2026-53168}
• ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
• xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
• ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options {CVE-2026-53249}
• ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• uio_hv_generic: Let userspace take care of interrupt mask {CVE-2025-40048}
• net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947}
• net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
• libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
• libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
• netfilter: nft_ct: fix missing expect put in obj eval {CVE-2026-52970}
• netfilter: nf_tables: always walk all pending catchall elements {CVE-2026-23278}
• crypto: af_alg - Cap AEAD AD length to 0x80000000 {CVE-2026-52972}
• wifi: cfg80211: advance loop vars in cfg80211_merge_profile() {CVE-2026-64174}
• NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr {CVE-2026-53391}
• Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock {CVE-2026-63945}
• pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
• RDMA/vmw_pvrdma: Fix…

These are all security issues fixed in the xen-4.21.1_06-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

Root has patched CVE-2025-54518 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2025-54518 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).
• CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449).
• CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (aka Dirty Frag) (bsc#1264450).
• CVE-2026-46333: ptrace: Logic bug in the Linux kernel's __ptrace_may_access() function (bsc#1265308).

The following non security issues were fixed:

• io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).
• CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449).
• CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (aka Dirty Frag) (bsc#1264450)
• CVE-2026-46333: ptrace: Logic bug in the Linux kernel's __ptrace_may_access() function (bsc#1265308).

The following non security issues were fixed:

• io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes).

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).
• CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449).
• CVE-2026-46333: Fixed logic bug in the Linux kernel's __ptrace_may_access() function (bsc#1265308).

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix the following issue:

Security issues fixed:

• CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449).
• CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (bsc#1264450).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).
• CVE-2026-46333: Fixed logic bug in the Linux kernel's __ptrace_may_access() function (bsc#1265308).

Other issues fixed:

• io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes).

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).
• CVE-2026-46333: Fixed logic bug in the Linux kernel's __ptrace_may_access() function (bsc#1265308).

The following non security issues were fixed:

• io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes).

The SUSE Linux Enterprise 15 SP4 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).
• CVE-2026-46333: Fixed logic bug in the Linux kernel's __ptrace_may_access() function (bsc#1265308).

The following non security issues were fixed:

• io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes).

This update for xen fixes the following issue

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264066).

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).
• CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags (bsc#1264449).
• CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (aka Dirty Frag) (bsc#1264450)
• CVE-2026-46333: ptrace: Logic bug in the Linux kernel's __ptrace_may_access() function (bsc#1265308).

The following non security issue was fixed:

• io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes).

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).
• CVE-2026-46333: ptrace: Logic bug in the Linux kernel's __ptrace_may_access() function (bsc#1265308).

This update for xen fixes the following issue

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264066).

This update for xen fixes the following issues

• CVE-2025-54505: Floating Point Divider State Sampling on AMD CPUs AMD-SN-7053 (bsc#1262428).
• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264066).
• CVE-2026-23557: Xenstored DoS via XS_RESET_WATCHES command (bsc#1262178).
• CVE-2026-23558: grant table v2 race in status page mapping (bsc#1262180).

This update for xen fixes the following issues

• CVE-2025-54505: Floating Point Divider State Sampling on AMD CPUs AMD-SN-7053 (bsc#1262428).
• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264066).
• CVE-2026-23557: Xenstored DoS via XS_RESET_WATCHES command (bsc#1262178).
• CVE-2026-23558: grant table v2 race in status page mapping (bsc#1262180).

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2021-47103: inet: fully convert sk->sk_rx_dst to RCU rules (bsc#1221010).
• CVE-2023-20585: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-23239: espintcp: Fix race condition in espintcp_close() (bsc#1259485).
• CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx() (bsc#1259484).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23393: bridge: cfm: Fix race condition in peer_mep deletion (bsc#1260522).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23462: Bluetooth: HIDP: Fix possible UAF (bsc#1261710).
• CVE-2026-31402: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (bsc#1261638).
• CVE-2026-31403: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd (bsc#1261796).
• CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (bsc#1261797).
• CVE-2026-31436: dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc() (bsc#1262602).
• CVE-2026-31504: net: fix fanout UAF in packet_release() via NETDEV_UP race (bsc#1263085).
• CVE-2026-31507: net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (bsc#1263095).
• CVE-2026-31512: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (bsc#1262734).
• CVE-2026-31533: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (bsc#1262758).
• CVE-2026-31570: can: gw: fix OOB heap access in cgw_csum_crc8_rel() (bsc#1263065).
• CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (bsc#1263176).
• CVE-2026-31588: KVM: x86: Use scratch field in MMIO fragment to hold small write values (bsc#1263165).
• CVE-2026-31602: ALSA: ctxfi: Limit PTP to a single page (bsc#1263723).
• CVE-2026-31607: usbip: validate number_of_packets in usbip_pack_ret_submit() (bsc#1263600).
• CVE-2026-31649: net: stmmac: fix integer underflow in chain mode (bsc#1263582).
• CVE-2026-31656: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (bsc#1263170).
• CVE-2026-31662: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (bsc#1263131).
• CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established (bsc#1263141).
• CVE-2026-31685: netfilter: ip6t_eui64: reject invalid MAC header for all packets (bsc#1263668).
• CVE-2026-31694: fuse: reject oversized dirents in page cache (bsc#1263901).
• CVE-2026-31700: net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (bsc#1263882).
• CVE-2026-31738: vxlan: validate ND option lengths in vxlan_na_create (bsc#1264059).
• CVE-2026-31787: xen/privcmd: fix double free via VMA splitting (bsc#1262181).
• CVE-2026-43025: netfilter: ctnetlink: ignore explicit helper on new expectations (bsc#1263931).
• CVE-2026-43027: netfilter: nf_conntrack_helper: pass helper to expect cleanup (bsc#1263933).
• CVE-2026-43050: atm: lec: fix use-after-free in sock_def_readable() (bsc#1264082).
• CVE-2026-43110: wifi: brcmfmac: validate bsscfg indices in IF events (bsc#1264482).
• CVE-2026-43126: ALSA: mixer: oss: Add card disconnect checkpoints (bsc#1264634).
• CVE-2026-43190: netfilter: xt_tcpmss: check remaining length before reading optlen (bsc#1264848).
• CVE-2026-43214: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (bsc#1264651).
• CVE-2026-43329: netfilter: flowtable: strictly check for maximum number of actions (bsc#1265085).
• CVE-2026-43334: Bluetooth: SMP: force responder MITM…

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.34 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259798).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260908).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.37 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.5 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259798).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260908).
• CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260563).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.258 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259798).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.164 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259798).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260908).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.283 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259798).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.110 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259798).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260908).
• CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260563).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.272 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259798).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.184 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259798).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260908).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

This update for the SUSE Linux Enterprise Kernel 5.14.21-150500.55.116 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259798).
• CVE-2026-23274: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (bsc#1260908).
• CVE-2026-23317: drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (bsc#1260563).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).

The following non security issue was fixed:

• io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes).

This update for the SUSE Linux Enterprise Kernel 4.12.14-122.290 fixes various security issues

The following security issues were fixed:

• CVE-2025-54518: AMD-SN-7052: CPU OP Cache Corruption (bsc#1264096).
• CVE-2026-23243: RDMA/umad: Reject negative data_len in ib_umad_write (bsc#1259798).
• CVE-2026-46300: FragNesia attack: another xfrm/esp based local root exploit (bsc#1265224).
• CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic (bsc#1265384).

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2025-54518: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (bsc#1264013).
• CVE-2026-46300: net: skbuff: propagate shared-frag marker through pskb_copy() (bsc#1265209).
• CVE-2026-43500: rxrpc: unshare DATA/RESPONSE packets when paged frags are present (bsc#1264450).

The following non security issues were fixed:

• config: s390x/ppc64le: disable unsupported CONFIG_AFS_FS and CONFIG_AF_RXRPC (bsc#1264450).
• io-wq: check that the predecessor is hashed in io_wq_remove_pending() (git-fixes).