CVE-2026-31581

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)

• kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)

• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

• kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

• kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)

• kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)

• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

• kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

• kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)

• kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467)

• kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

• kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)

• kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

• kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)

• kernel: net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508)

• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

• kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)

• kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

• kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)

• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-31581 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-31581 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-31581 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2026-31581 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-31581 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)

• kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)

• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

• kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)

• kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)

• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)

• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)

• kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)

• kernel: net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508)

• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)

• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)

• kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)

• kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)

• kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)

• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)

• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix use-after-free on disconnect In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed() is called and no file handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL write then hits freed slab memory. Call trace: usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 ... hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953 Fix by moving the card lifecycle out of usb6fire_chip_abort() and into usb6fire_chip_disconnect(). The card pointer is saved in a local before any teardown, snd_card_disconnect() is called first to prevent new opens, URBs are aborted while chip is still valid, and snd_card_free_when_closed() is called last so chip is never accessed after the card may be freed.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)
• kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)
• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
• kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)
• kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)
• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: geneve: Fix use-after-free in geneve_find_dev(). (CVE-2025-21858)
• kernel: smc: Fix use-after-free in tcp_write_timer_handler() (CVE-2023-53781)
• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
• kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984)
• kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990)
• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
• kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)
• kernel: Linux kernel: Denial of Service in erofs filesystem (CVE-2026-31467)
• kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
• kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)
• kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216)
• kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419)
• kernel: net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508)
• kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
• kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037)
• kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
• kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)
• kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
• kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501)
• kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
• kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
• xfrm: esp: avoid in-place decrypt on shared skb frags
• clk: Fix clk_hw_get_clk() when dev is NULL {CVE-2022-49187}
• x86/sgx: Add overflow check in sgx_validate_offset_length() {CVE-2022-49785}
• ext4: init quota for 'old.inode' in 'ext4_rename' {CVE-2022-50346}
• skbuff: Account for tail adjustment during pull operations {CVE-2022-50365}
• net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory {CVE-2022-50409}
• scsi: qla2xxx: Delay module unload while fabric scan in progress {CVE-2025-71235}
• HID: alps: fix NULL pointer dereference in alps_raw_event() {CVE-2026-31625}
• rxrpc: fix reference count leak in rxrpc_server_keyring() {CVE-2026-31634}
• drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
• ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects {CVE-2023-54010}
• drm/amdgpu: fix the waring dereferencing hive {CVE-2024-46805}
• drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func {CVE-2024-49911}
• tracing: Prevent bad count for tracing_cpumask_write {CVE-2024-56763}
• HID: wacom: fix when get product name maybe null pointer {CVE-2024-56629}
• thermal: int340x: Add NULL check for adev {CVE-2025-23136}
• wifi: mac80211: Purge vif txq in ieee80211_do_stop() {CVE-2025-37794}
• Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
• wifi: cfg80211: ocb: don't leave if not joined {CVE-2023-53992}
• mmc: core: Fix kernel panic when remove non-standard SDIO card {CVE-2022-50640}
• EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() {CVE-2022-50645}
• serial: amba-pl011: avoid SBSA UART accessing DMACR register {CVE-2022-50625}
• inet_diag: Initialize pad field in struct inet_diag_req_v2 {CVE-2024-42106}
• regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt {CVE-2022-49481}
• net/core: Fix ETH_P_1588 flow dissector {CVE-2023-52580}
• mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() {CVE-2023-52560}
• af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg {CVE-2024-38596}
• drm/amd/display: Implement bounds check for stream encoder creation in DCN301 {CVE-2024-26660}
• block: prevent division by zero in blk_rq_stat_sum() {CVE-2024-35925}
• netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286}
• tipc: fix a possible memleak in tipc_buf_append {CVE-2024-36954}
• ipv6: prevent possible NULL deref in fib6_nh_init() {CVE-2024-40961}
• pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER {CVE-2024-42090}
• ipv6: prevent possible NULL dereference in rt6_probe() {CVE-2024-40960}
• drm/radeon: check bo_va->bo is non-NULL before using it {CVE-2024-41060}
• dma: fix call order in dmam_free_coherent {CVE-2024-43856}
• scsi: qla2xxx: Fix for possible memory corruption {CVE-2024-42288}
• ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt {CVE-2024-26774}
• netfilter: flowtable: incorrect pppoe tuple {CVE-2024-27015}
• bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() {CVE-2024-40919}
• Bluetooth: btintel: Fix null ptr deref in btintel_read_version {CVE-2024-35933}
• netdevsim: prevent bad user input in nsim_dev_health_break_write() {CVE-2024-56716}
• net/mlx5e: CT: Fix null-ptr-deref in add rule err flow {CVE-2024-53120}
• EDAC/bluefield: Fix potential integer overflow {CVE-2024-53161}
• NFSD: Prevent NULL dereference in nfsd4_process_cb_update() {CVE-2024-53217}
• ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() {CVE-2024-50304}
• blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race {CVE-2024-50082}
• drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
• HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
• filemap: Fix bounds checking in filemap_read()…

• fix: "vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}"
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag {CVE-2026-23105}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• via_wdt: fix critical boot hang due to unnamed resource allocation {CVE-2025-71114}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• Revert "fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}"
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• btrfs: output extra debug info if we failed to find an inline backref {CVE-2023-53672}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release(CVE-2023-53484)
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mxds|mx {CVE-2022-50521}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
• i2c: ismt: use correct length when copy buffer {CVE-2022-50394}
• misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• kvm: avoid speculation-based attacks from out-of-range memslot accesses {CVE-2021-47277}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• USB: core: Add routines for endpoint checks in old drivers
• xen: sync some headers with xen tree
• squashfs: fix memory leak in squashfs_fill_super {CVE-2025-38415}
• pptp: fix pptp_xmit() error path {CVE-2025-38574}
• Revert "net/sched: sch_hfsc: Ensure inner classes have fsc curve" {CVE-2023-4623}

• fix: "vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}"
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag {CVE-2026-23105}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• via_wdt: fix critical boot hang due to unnamed resource allocation {CVE-2025-71114}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• Revert "fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}"
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• btrfs: output extra debug info if we failed to find an inline backref {CVE-2023-53672}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release(CVE-2023-53484)
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mxds|mx {CVE-2022-50521}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
• i2c: ismt: use correct length when copy buffer {CVE-2022-50394}
• misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• kvm: avoid speculation-based attacks from out-of-range memslot accesses {CVE-2021-47277}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• USB: core: Add routines for endpoint checks in old drivers
• xen: sync some headers with xen tree
• squashfs: fix memory leak in squashfs_fill_super {CVE-2025-38415}
• pptp: fix pptp_xmit() error path {CVE-2025-38574}
• Revert "net/sched: sch_hfsc: Ensure inner classes have fsc curve" {CVE-2023-4623}

• fix: "vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}"
• gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
• can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag {CVE-2026-23105}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• via_wdt: fix critical boot hang due to unnamed resource allocation {CVE-2025-71114}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• Revert "fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}"
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• btrfs: output extra debug info if we failed to find an inline backref {CVE-2023-53672}
• ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
• netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
• ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
• net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
• udf: Do not bother merging very long extents {CVE-2023-53506}
• lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release(CVE-2023-53484)
• lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
• ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
• md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
• platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mxds|mx {CVE-2022-50521}
• binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
• ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
• i2c: ismt: use correct length when copy buffer {CVE-2022-50394}
• misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
• ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
• ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
• KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
• kvm: avoid speculation-based attacks from out-of-range memslot accesses {CVE-2021-47277}
• scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219}
• scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• USB: core: Add routines for endpoint checks in old drivers
• xen: sync some headers with xen tree
• squashfs: fix memory leak in squashfs_fill_super {CVE-2025-38415}
• pptp: fix pptp_xmit() error path {CVE-2025-38574}
• Revert "net/sched: sch_hfsc: Ensure inner classes have fsc curve" {CVE-2023-4623}

• fbcon: Fix OOB access in font allocation {CVE-2025-39967}
• fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
• macvlan: observe an RCU grace period in macvlan_common_newlink() error path {CVE-2026-23273}
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• net_sched: sch_sfq: move the limit validation {CVE-2025-37752}
• bpf: Fix oob access in cgroup local storage {CVE-2025-38502}
• ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT {CVE-2026-43475}
• unshare: fix unshare_fs() handling {CVE-2026-43472}
• netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
• nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
• e1000/e1000e: Fix leak in DMA error cleanup {CVE-2026-43445}
• cgroup: fix race between task migration and iteration {CVE-2026-43439}
• ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
• usb: image: mdc800: kill download URB on timeout {CVE-2026-43425}
• tipc: fix divide-by-zero in tipc_sk_filter_connect() {CVE-2026-43411}
• nouveau/dpcd: return EBUSY for aux xfer if the device is asleep {CVE-2026-43381}
• ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() {CVE-2026-43068}
• netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP {CVE-2026-31424}
• net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() {CVE-2026-31423}
• net/sched: cls_flow: fix NULL pointer dereference on shared blocks {CVE-2026-31422}
• net/sched: cls_fw: fix NULL pointer dereference on shared blocks {CVE-2026-31421}
• netfilter: ipset: drop logically empty buckets in mtype_del {CVE-2026-31418}
• netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
• sunrpc: fix cache_request leak in cache_release {CVE-2026-31400}
• PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
• net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
• netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• RDMA/umem: Fix double dma_buf_unpin in failure path {CVE-2026-43128}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454}
• netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() {CVE-2025-38441}
• nvmet: fix memory leak of bio integrity {CVE-2025-38405}
• nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. {CVE-2025-38400}
• dmaengine: idxd: fix memory leak in error handling path of idxd_alloc {CVE-2025-38015}
• bonding: check xdp prog when set bond mode {CVE-2025-22105}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD {CVE-2026-31428}
• netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp {CVE-2026-31427}
• ipv6: avoid overflows in ip6_datagram_send_ctl() {CVE-2026-31415}
• net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
• RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243}
• perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344}
• x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363}
• dm: remove fake timeout to avoid leak request {CVE-2026-43314}
• drm: Account property blob allocations to memcg {CVE-2026-43287}
• HID:…

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• kyber: fix out of bounds access when preempted {CVE-2021-46984}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• tls: separate no-async decryption request handling from async {CVE-2024-58240}
• ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• nfsd: fix use-after-free due to delegation race {CVE-2021-47506}
• drm: bridge/panel: Cleanup connector on bridge detach {CVE-2021-47063}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer {CVE-2021-47226}
• kvm: LAPIC: Restore guard to prevent illegal APIC register access {CVE-2021-47255}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) {CVE-2019-7221}
• RDMA/umad: Reject negative data_len in…

• CVE-2022-49267
  • mmc: core: use sysfs_emit() instead of sprintf() {CVE-2022-49267}
  • mmc: sdio: Export SDIO revision and info strings to userspace {CVE-2022-49267}
• CVE-2026-43040
  • net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• CVE-2026-43027
  • netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• CVE-2025-71091
  • team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• CVE-2025-71075
  • scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• CVE-2025-38565
  • perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• CVE-2025-38401
  • mtk-sd: Prevent memory corruption from DMA map failure {CVE-2025-38401}
• CVE-2023-53218
  • rxrpc: Make it so that a waiting process can be aborted {CVE-2023-53218}
• CVE-2025-38230
  • jfs: validate AG parameters in dbMount() to prevent crashes {CVE-2025-38230}
• CVE-2023-52867
  • drm/radeon: possible buffer overflow {CVE-2023-52867}
• CVE-2023-53432
  • firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
• CVE-2025-39891
  • wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
• CVE-2025-38666
  • net: appletalk: Fix use-after-free in AARP proxy probe {CVE-2025-38666}
• CVE-2025-39828
  • atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() {CVE-2025-39828}
• CVE-2026-43020
  • Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• CVE-2026-43011
  • net/x25: Fix potential double free of skb {CVE-2026-43011}
• CVE-2026-31778
  • ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• CVE-2026-31748
  • comedi: me_daq: Fix potential overrun of firmware buffer {CVE-2026-31748}
• CVE-2026-31747
  • comedi: me4000: Fix potential overrun of firmware buffer {CVE-2026-31747}
• CVE-2026-31720
  • usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• CVE-2026-31696
  • rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696}
• CVE-2026-31659
  • batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• CVE-2026-31629
  • nfc: llcp: add missing return after LLCP_CLOSED checks {CVE-2026-31629}
• CVE-2026-31626
  • staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() {CVE-2026-31626}
• CVE-2026-31622
  • NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622}
• CVE-2026-31602
  • ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• CVE-2026-31583
  • media: em28xx: fix use-after-free in em28xx_v4l2_open() {CVE-2026-31583}
• CVE-2026-31581
  • ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• CVE-2026-31576
  • media: hackrf: fix to not free memory after the device is registered in hackrf_probe() {CVE-2026-31576}
• CVE-2026-31504
  • net: fix fanout UAF in packet_release() via NETDEV_UP race {CVE-2026-31504}
• CVE-2026-23388
  • Squashfs: check metadata block offset is within range {CVE-2026-23388}
• CVE-2026-23372
  • nfc: rawsock: cancel tx_work before socket teardown {CVE-2026-23372}
• Bump ABI 4.15.0-259

• CVE-2026-31602
  • ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• CVE-2026-43241
  • ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access {CVE-2026-43241}
• CVE-2026-23281
  • wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• CVE-2025-71116
  • libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• CVE-2022-49892
  • ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
• CVE-2022-3625
  • devlink: Fix use-after-free after a failed reload {CVE-2022-3625}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2026-31581
  • ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• CVE-2025-68366
  • nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• CVE-2026-43203
  • atm: fore200e: fix use-after-free in tasklets during device removal {CVE-2026-43203}
• CVE-2026-23361
  • PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry {CVE-2026-23361}
• CVE-2025-71082
  • Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• CVE-2025-71199
  • iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver {CVE-2025-71199}
• CVE-2026-31626
  • staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() {CVE-2026-31626}
• CVE-2026-43427
  • usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• CVE-2025-71136
  • media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() {CVE-2025-71136}
• CVE-2026-31780
  • wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation {CVE-2026-31780}
• CVE-2026-43052
  • wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• CVE-2026-43386
  • staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386}
• CVE-2026-43370
  • drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• CVE-2026-43011
  • net/x25: Fix potential double free of skb {CVE-2026-43011}
• CVE-2026-43027
  • netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• CVE-2026-43020
  • Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• CVE-2026-31748
  • comedi: me_daq: Fix potential overrun of firmware buffer {CVE-2026-31748}
• CVE-2026-31747
  • comedi: me4000: Fix potential overrun of firmware buffer {CVE-2026-31747}
• CVE-2026-31696
  • rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696}
• CVE-2026-31452
  • ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• CVE-2026-31399
  • nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• CVE-2026-43450
  • netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• CVE-2024-26988
  • init/main.c: Fix potential static_command_line memory overflow {CVE-2024-26988}
• Miscellaneous upstream changes
  • ubuntu20: de-symlink debian/changelog to a real copy
• Bump ABI 5.4.0-232

• KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}

• CVE-2026-46113
  • KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• CVE-2024-39467
  • f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() {CVE-2024-39467}
• CVE-2023-52796
  • ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2022-49934
  • wifi: mac80211: Fix UAF in ieee80211_scan_rx() {CVE-2022-49934}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2025-39686
  • comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
• CVE-2022-50169
  • wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() {CVE-2022-50169}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2026-23001
  • macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
• CVE-2026-31527
  • driver core: platform: use generic driver_override infrastructure {CVE-2026-31527}
• CVE-2026-46300
  • net: skbuff: preserve shared-frag marker during coalescing {CVE-2026-46300}
  • net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-46300}
• CVE-2026-23281
  • wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• CVE-2022-50279
  • wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279}
• CVE-2025-39901
  • i40e: remove read access to debugfs files {CVE-2025-39901}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2024-58072
  • wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}
• CVE-2025-38377
  • rose: fix dangling neighbour pointers in rose_rt_device_down() {CVE-2025-38377}
• CVE-2025-71091
  • team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-21811
  • nilfs2: protect access to buffers with no active references {CVE-2025-21811}
• CVE-2025-39955
  • tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955}
• CVE-2025-38702
  • fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
• CVE-2026-31500
  • Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• CVE-2025-39911
  • i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
• CVE-2025-38102
  • VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
• CVE-2025-38565
  • perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• CVE-2023-53153
  • wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
• CVE-2025-39866
  • fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• CVE-2025-38724
  • nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
• CVE-2026-31581
  • ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• CVE-2025-71082
  • Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-31627
  • i2c: s3c24xx: check the size of the SMBUS message before using it {CVE-2026-31627}
• CVE-2026-31452
  • ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• CVE-2026-23397
  • nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• CVE-2025-71093 -…

• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• xfs: delete attr leaf freemap entries when empty {CVE-2026-43158}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• brcmfmac: add subtype check for event handling in data path {CVE-2019-9503}
• nl80211: validate beacon head {CVE-2019-16746}
• ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c {CVE-2018-19824}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• mac80211: Reject malformed SSID elements {CVE-2019-17133}

• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• xfs: delete attr leaf freemap entries when empty {CVE-2026-43158}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• brcmfmac: add subtype check for event handling in data path {CVE-2019-9503}
• nl80211: validate beacon head {CVE-2019-16746}
• ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c {CVE-2018-19824}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• mac80211: Reject malformed SSID elements {CVE-2019-17133}

• Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek
• sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison {CVE-2026-53309}
• ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043}
• ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• Squashfs: check metadata block offset is within range {CVE-2026-23388}
• net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
• wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396}
• icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
• HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
• net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
• wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
• drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356}
• batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
• ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
• nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
• mm:…

• Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28.
• CVE-2021-46984
  • kyber: fix out of bounds access when preempted {CVE-2021-46984}
• CVE-2021-47049
  • Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
• CVE-2021-47101
  • asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• CVE-2021-47191
  • scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
• CVE-2021-47352
  • virtio-net: Add validation for used length {CVE-2021-47352}
• CVE-2021-47379
  • blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
• CVE-2021-47391
  • RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
• CVE-2021-47479
  • staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}
• CVE-2022-21546
  • scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
• CVE-2022-39189
  • KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
• CVE-2022-43945
  • SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
  • NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2022-49026
  • e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
• CVE-2022-49720
  • block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
• CVE-2022-49975
  • bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
  • bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2022-50103
  • sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
• CVE-2022-50129
  • RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129}
  • RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
• CVE-2022-50300
  • btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
• CVE-2022-50406
  • iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50552
  • blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
• CVE-2023-51779
  • Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
• CVE-2023-52434
  • smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• CVE-2023-52515
  • RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• CVE-2023-52531
  • wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
• CVE-2023-52741
  • cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
• CVE-2023-53000
  • netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
• CVE-2023-53039
  • workqueue: Add resource managed version of delayed work init {CVE-2023-53039}
  • devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039}
  • devm-helpers: Add resource managed version of work init {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039}
• CVE-2023-53111
  • loop: Fix use-after-free issues {CVE-2023-53111}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels…

• ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
• ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}
• net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
• drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
• drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}
• tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
• ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}
• vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}
• tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
• dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
• scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
• drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
• nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
• USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
• ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
• geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
• wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
• ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
• net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
• bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
• bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961}
• dm cache: fix null-deref with concurrent writes in passthrough mode {CVE-2026-53064}
• net: bonding: fix use-after-free after 802.3ad slave unbind {CVE-2022-49667}
• bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}
• xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
• NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
• Squashfs: check block offset is not negative {CVE-2026-90203}
• wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
• uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
• md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}
• tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
• crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
• nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}
• ALSA: 6fire: fix use-after-free on disconnect…

In the Linux kernel, the following vulnerability has been resolved:

ALSA: 6fire: fix use-after-free on disconnect

In usb6fire_chip_abort(), the chip struct is allocated as the card's private data (via snd_card_new with sizeof(struct sfire_chip)). When snd_card_free_when_closed() is called and no file handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL write then hits freed slab memory.

Call trace: usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 ... hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953

Fix by moving the card lifecycle out of usb6fire_chip_abort() and into usb6fire_chip_disconnect(). The card pointer is saved in a local before any teardown, snd_card_disconnect() is called first to prevent new opens, URBs are aborted while chip is still valid, and snd_card_free_when_closed() is called last so chip is never accessed after the card may be freed.

These are all security issues fixed in the kernel-devel-7.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2026-23259: io_uring/rw: free potentially allocated iovec on cache put failure (bsc#1259866).
• CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled (bsc#1262652).
• CVE-2026-31561: x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (bsc#1263059).
• CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit (bsc#1264267).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43204: ASoC: qcom: q6asm: handle the responses after closing (bsc#1264531).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
• CVE-2026-43275: scsi: ufs: core: Flush exception handling work when RPM level is zero (bsc#1264303).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN (bsc#1264993).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (bsc#1264678).
• CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup (bsc#1265041).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45845: net/sched: taprio: fix NULL pointer dereference in class dump (bsc#1266393).
• CVE-2026-45849: net: mscc: ocelot: extract ocelot_xmit_timestamp() helper (bsc#1266690).
• CVE-2026-45859: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (bsc#1266714).
• CVE-2026-45865: mctp i2c: initialise event handler read bytes (bsc#1266694).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45895: quota: fix livelock between quotactl and freeze_super (bsc#1266882).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45930: net: mctp: ensure our nlmsg responses are initialised (bsc#1266730).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify:…

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item (bsc#1255703).
• CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path" (bsc#1256675).
• CVE-2026-23097: migrate: correct lock ordering for hugetlb file folios (bsc#1257815).
• CVE-2026-43016: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready() (bsc#1264007).
• CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (bsc#1264601).
• CVE-2026-43130: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode (bsc#1264532).
• CVE-2026-43161: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode (bsc#1264333).
• CVE-2026-43168: ocfs2: fix reflink preserve cleanup issue (bsc#1264537).
• CVE-2026-43170: usb: dwc3: gadget: Move vbus draw to workqueue context (bsc#1264452).
• CVE-2026-43172: wifi: iwlwifi: fix 22000 series SMEM parsing (bsc#1264543).
• CVE-2026-43216: net: Drop the lock in skb_may_tx_timestamp() (bsc#1264319).
• CVE-2026-43230: net/rds: Clear reconnect pending bit (bsc#1264539).
• CVE-2026-43244: kcm: fix zero-frag skb in frag_list on partial sendmsg error (bsc#1264321).
• CVE-2026-43262: gfs2: fiemap page fault fix (bsc#1264422).
• CVE-2026-43266: EFI/CPER: don't go past the ARM processor CPER record buffer (bsc#1264418).
• CVE-2026-43281: mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (bsc#1264534).
• CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (bsc#1264712).
• CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid (bsc#1264827).
• CVE-2026-43328: cpufreq: governor: Free dbs_data directly when gov->init() fails (bsc#1264832).
• CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (bsc#1265089).
• CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
• CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (bsc#1265009).
• CVE-2026-43496: net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked (bsc#1266000).
• CVE-2026-45839: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() (bsc#1266399).
• CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
• CVE-2026-45873: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets (bsc#1266715).
• CVE-2026-45877: HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients (bsc#1266468).
• CVE-2026-45905: xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path (bsc#1266685).
• CVE-2026-45913: net: bridge: mcast: always update mdb_n_entries for vlan contexts (bsc#1266891).
• CVE-2026-45915: fat: avoid parent link count underflow in rmdir (bsc#1266896).
• CVE-2026-45917: ipvs: do not keep dest_dst if dev is going down (bsc#1266900).
• CVE-2026-45944: iommu/vt-d: Clear Present bit before tearing down context entry (bsc#1267203).
• CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload (bsc#1267025).
• CVE-2026-45981: s390/cio: Fix device lifecycle handling in css_alloc_subchannel() (bsc#1267204).
• CVE-2026-45994: ibmasm: fix OOB reads in command_file_write due to missing size checks (bsc#1267432).
• CVE-2026-46003: net: qrtr: ns: Limit the total number of nodes (bsc#1267210).
• CVE-2026-46015: tcp: call sk_data_ready() after listener migration (bsc#1267439).
• CVE-2026-46023: dm mirror: fix integer overflow in create_dirty_log() (bsc#1267449).
• CVE-2026-46026: net: qrtr: ns: Limit the maximum number of lookups (bsc#1266876).
• CVE-2026-46027: net/smc: avoid early lgr access in smc_clc_wait_msg (bsc#1266744).
• CVE-2026-46038: net: qrtr: ns: Free the node during ctrl_cmd_bye() (bsc#1266695).
• CVE-2026-46040: inotify: fix…