CVE-2026-68377

net/sched: act_tunnel_key: Defer dst_release to RCU callback

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_tunnel_key: Defer dst_release to RCU callback

Fix a race-condition use-after-free in tunnel_key_release_params().

The function releases the metadata_dst of the old params synchronously via dst_release() while deferring the params struct free with kfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may still hold the old params pointer (under rcu_read_lock_bh) and proceed to call dst_clone(&params->tcft_enc_metadata->dst) after the writer's dst_release has already pushed the dst's rcuref to RCUREF_DEAD.

[email protected] produced a poc which i (and Victor) verified that KASAN reports:

================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 BUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 BUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109 BUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173 BUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168 Write of size 4 at addr ffff88806158de40 by task poc/9388

CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 print_report+0x139/0x4ad mm/kasan/report.c:482 kasan_report+0xe4/0x1d0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 kasan_check_range+0x125/0x200 mm/kasan/generic.c:200 instrument_atomic_read_write include/linux/instrumented.h:112 atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 __rcuref_put include/linux/rcuref.h:109 rcuref_put include/linux/rcuref.h:173 dst_release+0x5b/0x370 net/core/dst.c:168 refdst_drop include/net/dst.h:272 skb_dst_drop include/net/dst.h:284 skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163 skb_release_all net/core/skbuff.c:1187 [..] Allocated by task 9391: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 __kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 __do_kmalloc_node mm/slub.c:5296 __kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 kzalloc_noprof include/linux/slab.h:1188 offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35 tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258 tcf_action_offload_add net/sched/act_api.c:293 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101 [..] Freed by task 9391: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 __kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 slab_free_hook mm/slub.c:2689 slab_free mm/slub.c:6251 kfree+0x21f/0x6b0 mm/slub.c:6566 tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284 tcf_action_offload_add net/sched/act_api.c:293 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101

The buggy address belongs to the object at ffff88806158de00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 64 bytes inside of freed 256-byte region [ffff88806158de00, ffff88806158df00)

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entire_map ---truncated---

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.13%Unchanged since Aug 11, 2026

What each source reports

CVE List Score used 7.8

net/sched: act_tunnel_key: Defer dst_release to RCU callback

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_tunnel_key: Defer dst_release to RCU callback

Fix a race-condition use-after-free in tunnel_key_release_params().

[email protected] produced a poc which i (and Victor) verified that KASAN reports:

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entire_map ---truncated---

Record: CVE-2026-68377
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2026-55563 7.8

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_tunnel_key: Defer dst_release to RCU callback

Fix a race-condition use-after-free in tunnel_key_release_params().

[email protected] produced a poc which i (and Victor) verified that KASAN reports:

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entire_map ---truncated---

Record: EUVD-2026-55563
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5xw4-524v-v442 7.8

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_tunnel_key:...

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_tunnel_key: Defer dst_release to RCU callback

Fix a race-condition use-after-free in tunnel_key_release_params().

[email protected] produced a poc which i (and Victor) verified that KASAN reports:

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entire_map ---truncated---

Record: GHSA-5xw4-524v-v442
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_tunnel_key: Defer dst_release to RCU callback

Fix a race-condition use-after-free in tunnel_key_release_params().

[email protected] produced a poc which i (and Victor) verified that KASAN reports:

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entire_map ---truncated---

Record: CVE-2026-68377
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2026-68377 7.8

Record: BELL-CVE-2026-68377
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 7.8

net/sched: act_tunnel_key: Defer dst_release to RCU callback

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_tunnel_key: Defer dst_release to RCU callback

Fix a race-condition use-after-free in tunnel_key_release_params().

[email protected] produced a poc which i (and Victor) verified that KASAN reports:

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entire_map ---truncated---

Record: CVE-2026-68377
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 48 moreShow less

OSVDEBIAN-CVE-2026-68377 7.8

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_tunnel_key: Defer dst_release to RCU callback Fix a race-condition use-after-free in tunnel_key_release_params(). The function releases the metadata_dst of the old params synchronously via dst_release() while deferring the params struct free with kfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may still hold the old params pointer (under rcu_read_lock_bh) and proceed to call dst_clone(&params->tcft_enc_metadata->dst) after the writer's dst_release has already pushed the dst's rcuref to RCUREF_DEAD. [email protected] produced a poc which i (and Victor) verified that KASAN reports: ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 BUG: KASAN: slab-use-after-free in atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 BUG: KASAN: slab-use-after-free in __rcuref_put include/linux/rcuref.h:109 BUG: KASAN: slab-use-after-free in rcuref_put include/linux/rcuref.h:173 BUG: KASAN: slab-use-after-free in dst_release+0x5b/0x370 net/core/dst.c:168 Write of size 4 at addr ffff88806158de40 by task poc/9388 CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 print_report+0x139/0x4ad mm/kasan/report.c:482 kasan_report+0xe4/0x1d0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 kasan_check_range+0x125/0x200 mm/kasan/generic.c:200 instrument_atomic_read_write include/linux/instrumented.h:112 atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:326 __rcuref_put include/linux/rcuref.h:109 rcuref_put include/linux/rcuref.h:173 dst_release+0x5b/0x370 net/core/dst.c:168 refdst_drop include/net/dst.h:272 skb_dst_drop include/net/dst.h:284 skb_release_head_state+0x293/0x400 net/core/skbuff.c:1163 skb_release_all net/core/skbuff.c:1187 [..] Allocated by task 9391: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 __kasan_kmalloc+0x9a/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 __do_kmalloc_node mm/slub.c:5296 __kmalloc_noprof+0x2f1/0x830 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 kzalloc_noprof include/linux/slab.h:1188 offload_action_alloc+0x2f/0x130 net/core/flow_offload.c:35 tcf_action_offload_add_ex+0x1ba/0x880 net/sched/act_api.c:258 tcf_action_offload_add net/sched/act_api.c:293 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101 [..] Freed by task 9391: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 __kasan_slab_free+0x6b/0x90 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 slab_free_hook mm/slub.c:2689 slab_free mm/slub.c:6251 kfree+0x21f/0x6b0 mm/slub.c:6566 tcf_action_offload_add_ex+0x4ad/0x880 net/sched/act_api.c:284 tcf_action_offload_add net/sched/act_api.c:293 tcf_action_init+0x66e/0xa20 net/sched/act_api.c:1547 tcf_action_add+0xf6/0x5d0 net/sched/act_api.c:2101 The buggy address belongs to the object at ffff88806158de00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 64 bytes inside of freed 256-byte region [ffff88806158de00, ffff88806158df00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c head: order:1 mapcount:0 entire_map ---truncated---

Record: DEBIAN-CVE-2026-68377
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:83156 8.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2026:83156
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:83157 8.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2026:83157
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:83159 8.8

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Record: RHSA-2026:83159
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:83207 8.1

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2026:83207
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:83156 8.8

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:83156
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:83157 8.8

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:Rocky Linux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:83157
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:83159 8.8

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:Rocky Linux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:83159
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:83207 8.1

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)
kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Bug Fix(es) and Enhancement(s):

cannot use VFs of i40e/ice NIC in bond device (JIRA:Rocky Linux-143410)
ionic: commit backported to 9.8 missing in 10.2 (JIRA:Rocky Linux-165657)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:83207
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-68377 7.8

Record: UBUNTU-CVE-2026-68377
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSVALSA-2026:83156 No score

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409)
kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:83156
Updated: 2026-11-02

OSVALSA-2026:83157 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:AlmaLinux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:83157
Updated: 2026-11-02

OSVALSA-2026:83159 No score

Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: net/sched: cls_route: fix fastmap use-after-free on filter (CVE-2026-74583)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)
kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262)

Bug Fix(es) and Enhancement(s):

powerpc/pseries: pci - logic bug in SR-IOV enable (JIRA:AlmaLinux-240146)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:83159
Updated: 2026-11-02

OSVALSA-2026:83207 No score

Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (CVE-2026-45859)
kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319)
kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011)
kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899)
kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032)
kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030)
kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974)
kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162)
kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377)
kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140)
kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262)
kernel: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CVE-2026-74574)
kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641)
kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985)
kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
kernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036)
kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207)
kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228)

Bug Fix(es) and Enhancement(s):

cannot use VFs of i40e/ice NIC in bond device (JIRA:AlmaLinux-143410)
ionic: commit backported to 9.8 missing in 10.2 (JIRA:AlmaLinux-165657)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:83207
Updated: 2026-11-02

OSVCLSA-2026-1787935638 No score

kernel: Fix of 164 CVEs

wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds {CVE-2023-53582}
net/sched: accept TCA_STAB only for root qdisc {CVE-2024-50039}
bpf, sockmap: Several fixes to bpf_msg_pop_data {CVE-2024-56720}
net: add more sanity checks to qdisc_pkt_len_init() {CVE-2024-49948}
nvme-tcp: sanitize request list handling {CVE-2025-38264}
smb: client: fix double free of TCP_Server_Info::hostname {CVE-2025-21673}
net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132}
RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856}
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056}
bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886}
libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119}
nfsd: never defer requests during idmap lookup {CVE-2026-45983}
openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840}
procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023}
thermal: core: Fix thermal zone governor cleanup issues {CVE-2026-46021}
tcp: call sk_data_ready() after listener migration {CVE-2026-46015}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935}
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195}
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218}
netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072}
netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
smb: client: fix krb5 mount with username option {CVE-2026-31392}
netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212}
USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196}
crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016}
netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
fuse: reject fuse_notify() pagecache ops on directories {CVE-2026-53168}
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239}
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options {CVE-2026-53249}
ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
uio_hv_generic: Let userspace take care of interrupt mask {CVE-2025-40048}
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947}
net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223}
libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955}
libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957}
netfilter: nft_ct: fix missing expect put in obj eval {CVE-2026-52970}
netfilter: nf_tables: always walk all pending catchall elements {CVE-2026-23278}
crypto: af_alg - Cap AEAD AD length to 0x80000000 {CVE-2026-52972}
wifi: cfg80211: advance loop vars in cfg80211_merge_profile() {CVE-2026-64174}
NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr {CVE-2026-53391}
Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock {CVE-2026-63945}
pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800}
RDMA/vmw_pvrdma: Fix…

Record: CLSA-2026-1787935638
Updated: 2026-11-02

OSVCLSA-2026-1789958474 No score

Fix of 167 CVEs

CVE-2025-39826
- net: rose: convert 'use' field to refcount_t {CVE-2025-39826}
CVE-2025-40146
- blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146}
CVE-2024-53216
- nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
CVE-2026-89778
- isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778}
CVE-2026-23050
- pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050}
CVE-2025-68796
- f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796}
CVE-2025-68330
- iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330}
CVE-2025-40333
- f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333}
CVE-2025-40160
- xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160}
CVE-2023-54047
- drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047}
CVE-2025-68190
- drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190}
CVE-2025-68188
- tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
CVE-2026-89786
- ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
CVE-2022-50764
- ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764}
CVE-2026-80785
- fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785}
CVE-2026-80788
- nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788}
CVE-2026-80747
- drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747}
CVE-2026-80907
- drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907}
CVE-2026-80908
- drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908}
CVE-2026-80812
- ALSA: dummy: Check card index validity at probe {CVE-2026-80812}
CVE-2026-80948
- wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948}
CVE-2025-40137
- f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137}
CVE-2023-54150
- drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150}
CVE-2026-89784
- SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784}
CVE-2026-89783
- xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783}
CVE-2026-89780
- net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780}
CVE-2026-89777
- vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777}
CVE-2026-89789
- gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789}
CVE-2025-68797
- char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797}
CVE-2025-68767
- hfsplus: Verify inode mode when loading from disk {CVE-2025-68767}
CVE-2026-63961
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961}
CVE-2026-63904
- usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
CVE-2022-50864
- nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864}
CVE-2025-68771
- ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771}
CVE-2025-68750
- usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750}
CVE-2026-80909
- drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909}
CVE-2026-74402
- crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} *…

Record: CLSA-2026-1789958474
Updated: 2026-11-02

OSVCLSA-2026-1789986443 No score

kernel: Fix of 121 CVEs

dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
mm/damon/core: validate ranges in damon_set_regions() {CVE-2026-68165}
netpoll: Fix deadlock in memory allocation under spinlock {CVE-2025-68169}
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size {CVE-2026-68258}
gve: fix Rx queue stall on alloc failure {CVE-2026-68129}
drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234}
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE {CVE-2026-68159}
media: v4l2-ctrls: validate HEVC active reference counts {CVE-2026-68206}
drm/i915/hdcp: check streams[] bounds before overflow {CVE-2026-68253}
drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() {CVE-2026-68245}
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() {CVE-2026-68115}
drm/i915: Return NULL on error in active_instance {CVE-2026-68248}
smb: client: validate DFS referral PathConsumed {CVE-2026-68343}
ext4: fix use-after-free in update_super_work when racing with umount {CVE-2026-31446}
debugobjects: Plug race against a concurrent OOM disable {CVE-2026-68090}
HID: wacom: stop hardware after post-start probe failures {CVE-2026-68091}
drm/xe/pt: Reset current_op in xe_pt_update_ops_init() {CVE-2026-68264}
net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD {CVE-2026-68288}
drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() {CVE-2026-68113}
openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}
drm/amd/display: use kvzalloc to allocate struct dc {CVE-2026-68436}
drm/i915/gem: Add missing nospec on parallel submit slot {CVE-2026-68269}
Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update {CVE-2026-68394}
sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162}
wifi: mt76: mt7925: fix crash in reset link replay {CVE-2026-68307}
Bluetooth: hci_sync: extend conn_hash lookup critical sections {CVE-2026-68393}
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU {CVE-2026-68243}
block: fix memory leak in __blkdev_issue_zero_pages {CVE-2026-68348}
drm/amdgpu/gfx: fix cleaner shader IB buffer overflow {CVE-2026-68276}
tracing: Do not call map->ops->elt_free() if elt_alloc() fails {CVE-2026-64173}
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362}
ovl: check access to copy_file_range source with src mounter creds {CVE-2026-68448}
drm/nouveau: fix reversed error cleanup order in ucopy functions {CVE-2026-68271}
vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
drm/vmwgfx: Validate vmw_surface_metadata::array_size {CVE-2026-68446}
net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM {CVE-2026-68296}
Input: elan_i2c - prevent division by zero and arithmetic underflow {CVE-2026-64275}
iomap: fix out-of-bounds bitmap_set() with zero-length range {CVE-2026-68145}
vsock: fix lock inversion in vsock_assign_transport() {CVE-2025-40231}
ASoC: nau8821: Cancel delayed work on component remove {CVE-2026-45963}
ext4: validate p_idx bounds in ext4_ext_correct_indexes {CVE-2026-31449}
ipc: fix memleak if msg_init_ns failed in create_ipc_ns {CVE-2024-53175}
tls: make sure to abort the stream if headers are bogus {CVE-2025-39946}
ipv6: prevent infinite loop in rt6_nlmsg_size() {CVE-2025-38588}
gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL {CVE-2026-23386}
xsk: validate MTU against usable frame size on bind {CVE-2026-43092}
RDMA/irdma: Harden depth calculation functions {CVE-2026-31491}
iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() {CVE-2026-31505}
net/ip6_tunnel: Prevent perpetual tunnel growth {CVE-2025-40173}
net/mlx5: Fix deadlock between devlink lock and esw->wq {CVE-2026-43468}
mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458}
fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling {CVE-2026-52946}
nvmet: move async event…

Record: CLSA-2026-1789986443
Updated: 2026-11-02

OSVCLSA-2026-1792977831 No score

kernel: Fix of 118 CVEs

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284}
usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
usb: usbfs: fix use-after-free of usb_device in usbdev_release() {CVE-2026-80824}
HID: alps: fix use-after-free on input2 registration failure {CVE-2026-98501}
scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() {CVE-2023-53754}
net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}
net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488}
net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489}
net: ena: fix MMIO read buffer leak on probe failure {CVE-2026-98486}
HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}
RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965}
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}
net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377}
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
ALSA: usbusx2y: validate URB actual_length in interrupt callback {CVE-2026-97929}
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf {CVE-2026-97930}
udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
wifi: iwlwifi: mvm: validate TX_CMD response layout {CVE-2026-93793}
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid {CVE-2026-97561}
wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345}
IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294}
NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151}
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed {CVE-2026-98359}
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates {CVE-2026-98099}
wifi: cfg80211: reject duplicate wiphy cipher suite entries {CVE-2026-97518}
IB/iser: reject a remote invalidation of an unregistered direction {CVE-2026-98358}
ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
ACPI: bus: Introduce acpi_bus_get_primary_device() {CVE-2026-93251}
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
smb: client: reject a tree connect response whose byte count is too small {CVE-2026-89631}
tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847}
fsnotify: Fix stale object mask after concurrent mark updates {CVE-2026-89595}
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638}
sunrpc: init…

Record: CLSA-2026-1792977831
Updated: 2026-11-02

OSVCLSA-2026-1792979087 No score

kernel: Fix of 118 CVEs

Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284}
usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904}
usb: usbfs: fix use-after-free of usb_device in usbdev_release() {CVE-2026-80824}
HID: alps: fix use-after-free on input2 registration failure {CVE-2026-98501}
scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() {CVE-2023-53754}
net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}
net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488}
net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489}
net: ena: fix MMIO read buffer leak on probe failure {CVE-2026-98486}
HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015}
RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965}
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921}
net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377}
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
ALSA: usbusx2y: validate URB actual_length in interrupt callback {CVE-2026-97929}
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf {CVE-2026-97930}
udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206}
wifi: iwlwifi: mvm: validate TX_CMD response layout {CVE-2026-93793}
smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid {CVE-2026-97561}
wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345}
IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294}
NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151}
sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed {CVE-2026-98359}
ipv6: mcast: use rcu_assign_pointer() for __rcu list updates {CVE-2026-98099}
wifi: cfg80211: reject duplicate wiphy cipher suite entries {CVE-2026-97518}
IB/iser: reject a remote invalidation of an unregistered direction {CVE-2026-98358}
ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048}
misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
ACPI: bus: Introduce acpi_bus_get_primary_device() {CVE-2026-93251}
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861}
smb: client: reject a tree connect response whose byte count is too small {CVE-2026-89631}
tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847}
fsnotify: Fix stale object mask after concurrent mark updates {CVE-2026-89595}
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638}
sunrpc: init…

Record: CLSA-2026-1792979087
Updated: 2026-11-02

OSVCLSA-2026-1792979985 No score

kernel: Fix of 154 CVEs

net: bridge: fix vlan tunnel dst refcnt when egressing {CVE-2021-47222}
net: bridge: fix vlan tunnel dst null pointer dereference {CVE-2021-47223}
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378}
writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount {CVE-2026-64378}
libceph: validate banner payload length {CVE-2026-90067}
drm/virtio: release the GEM object on virtio_gpu_vram_create() errors {CVE-2026-98606}
procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs {CVE-2026-74390}
nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685}
vdpa_sim_blk: reject out-of-range sector starts {CVE-2026-97991}
Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482}
nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386}
bpf: mark a NULL call argument precise {CVE-2026-98019}
bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get {CVE-2026-72262}
ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes() {CVE-2026-72262}
Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108}
mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
reboot: fix cad_pid use-after-free race {CVE-2026-97938}
fs/resctrl: Fix UAF from worker threads when domains are removed {CVE-2026-93099}
ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488}
sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
fanotify: fix false positive on permission events {CVE-2026-46150}
configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
sctp: diag: reject stale associations in dump_one path {CVE-2026-52917}
sctp: Hold sock lock while iterating over address list {CVE-2026-52917}
sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
nfsd: gate nfs3…

Record: CLSA-2026-1792979985
Updated: 2026-11-02

OSVMGASA-2026-0336 No score

Updated kernel, kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages fix security vulnerabilities

Upstream kernel 6.18.44 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Record: MGASA-2026-0336
Updated: 2026-11-02

OSVMGASA-2026-0337 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.18.44 fixes vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0337
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21910-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: openSUSE-SU-2026:21910-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23477-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23477-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23481-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23481-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23528-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944)
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23528-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23529-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31392: smb: client: fix krb5 mount with username option (bsc#1261788).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43278: dm: clear cloned request bio pointer when last clone bio completes (bsc#1264584).
CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock (bsc#1264788).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655).
CVE-2026-53076: bpf: Fix OOB in pcpu_init_value (bsc#1269695).
CVE-2026-53077: net/rds: Restrict use of RDS/IB to the initial network namespace (bsc#1269412).
CVE-2026-53089: bpf: Fix use-after-free in offloaded map/prog info fill (bsc#1269783).
CVE-2026-53091: net: account for encap headers in qdisc pkt len (bsc#1269530).
CVE-2026-53094: bpf: Fix stale offload->prog pointer after constant blinding (bsc#1269965).
CVE-2026-53096: bpf: Use RCU-safe iteration in…

Record: SUSE-SU-2026:23529-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23881-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23881-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23887-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23887-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23897-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23897-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23902-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-68358: btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (bsc#1255531).
CVE-2025-68780: sched/deadline: only set free_cpus for online runqueues (bsc#1256671).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-23113: io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (bsc#1258278).
CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command() (bsc#1260501).
CVE-2026-23348: cxl/mem: Clarify @host for devm_cxl_add_nvdimm() (bsc#1260577).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31530: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (bsc#1262756).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43239: smb: client: prevent races in ->query_interfaces() (bsc#1264444).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (bsc#1264851).
CVE-2026-43331: x86/kexec: Disable KCOV instrumentation after load_segments() (bsc#1265132).
CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path (bsc#1265036).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43439: cgroup: fix race between task migration and iteration (bsc#1265141).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45860: netfilter: nf_conncount: increase the connection clean up limit to 64 (bsc#1266710).
CVE-2026-45897: netfilter: nft_counter: serialize reset with spinlock (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46007: hwmon: (powerz) Avoid cacheline sharing for DMA buffer (bsc#1267586).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46133: RDMA/rxe: Reject unknown opcodes before ICRC processing (bsc#1266928).
CVE-2026-46135: nvmet-tcp: remove redundant calls to nvmet_tcp_fatal_error() (bsc#1267373).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52928: af_unix: Reject SIOCATMARK on non-stream sockets (bsc#1269010).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108). -…

Record: SUSE-SU-2026:23902-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4120-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 RT kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841: net: fix memory leak in tcp_conn_request() (bsc#1235944).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43014: net: macb: properly unregister fixed rate clocks (bsc#1264012).
CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
CVE-2026-53059: dm…

Record: SUSE-SU-2026:4120-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4254-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731).
CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225).
CVE-2025-71075: scsi: aic94xx: fix use-after-free in device removal path (bsc#1256629).
CVE-2026-31418: netfilter: ipset: drop logically empty buckets in mtype_del (bsc#1262073).
CVE-2026-31531: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (bsc#1263004).
CVE-2026-31557: nvmet: move async event work off nvmet-wq (bsc#1263061).
CVE-2026-31658: net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (bsc#1263052).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43014,CVE-2026-43015: net: macb: fix clk handling on PCI glue driver removal (bsc#1264010 bsc#1264012).
CVE-2026-43116: netfilter: ctnetlink: ensure safe access to master conntrack (bsc#1264619).
CVE-2026-43125: dlm: validate length in dlm_search_rsb_tree (bsc#1264541).
CVE-2026-43163: md/bitmap: fix GPF in write_page caused by resize race (bsc#1264335).
CVE-2026-43213: wifi: rtw89: pci: validate sequence number of TX release report (bsc#1264643).
CVE-2026-43271: md-cluster: fix NULL pointer dereference in process_metadata_update (bsc#1264587).
CVE-2026-43273: ceph: supply snapshot context in ceph_zero_partial_object() (bsc#1264446).
CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so (bsc#1265068).
CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (bsc#1264740).
CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain (bsc#1265121).
CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() (bsc#1264807).
CVE-2026-45897: bpf: Fix UAF in sock clone early bailouts (bsc#1266897).
CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023).
CVE-2026-46070: md/raid5: validate payload size before accessing journal metadata (bsc#1267501).
CVE-2026-46078: erofs: fix the out-of-bounds nameoff handling for trailing dirents (bsc#1267505).
CVE-2026-46091: media: rc: igorplugusb: heed coherency rules (bsc#1267238).
CVE-2026-46107: dm-thin: fix metadata refcount underflow (bsc#1267612).
CVE-2026-46115: block: add pgmap check to biovec_phys_mergeable (bsc#1266874).
CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (bsc#1267236).
CVE-2026-46195: smb: client: validate dacloffset before building DACL pointers (bsc#1266860).
CVE-2026-52920: netfilter: xt_policy: fix strict mode inbound policy matching (bsc#1269013).
CVE-2026-52925: vrf: Fix a potential NPD when removing a port from a VRF (bsc#1268987).
CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004).
CVE-2026-52935: xfrm: espintcp: do not reuse an in-progress partial send (bsc#1268979).
CVE-2026-52939: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion (bsc#1268972).
CVE-2026-52946: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling (bsc#1269113).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242).
CVE-2026-52990: fsnotify: fix inode reference leak in fsnotify_recalc_mask() (bsc#1269108).
CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126).
CVE-2026-53001: netfilter: xtables: restrict several matches to inet family (bsc#1269114).
CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter (bsc#1269388).
CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update (bsc#1269140).
CVE-2026-53059: dm log: fix out-of-bounds write due…

Record: SUSE-SU-2026:4254-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4687-1 No score

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues:

The following security issues were fixed:

CVE-2022-50645: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() (bsc#1254633).
CVE-2026-31663: xfrm: hold device only for the asynchronous decryption (bsc#1263133).
CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts (bsc#1265138).
CVE-2026-45834: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() (bsc#1266412).
CVE-2026-45836: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() (bsc#1266410).
CVE-2026-46044: ipmi:ssif: Clean up kthread on errors (bsc#1267464).
CVE-2026-46196: tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() (bsc#1266848).
CVE-2026-46304: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free (bsc#1267985).
CVE-2026-46312: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap (bsc#1267990).
CVE-2026-52975: bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner (bsc#1269234).
CVE-2026-53037: HID: usbhid: fix deadlock in hid_post_reset() (bsc#1269081).
CVE-2026-53237: gpio: mvebu: fix NULL pointer dereference in suspend/resume (bsc#1269131).
CVE-2026-53284: btrfs: only release the dirty pages io tree after successful writes (bsc#1269816).
CVE-2026-53385: vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write (bsc#1271834).
CVE-2026-53400: i2c: core: fix adapter registration race (bsc#1273953).
CVE-2026-63897: USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (bsc#1272642).
CVE-2026-63900: USB: serial: keyspan: fix missing indat transfer sanity check (bsc#1272499).
CVE-2026-63902: USB: serial: cypress_m8: validate interrupt packet headers (bsc#1272517).
CVE-2026-63903: USB: serial: belkin_sa: validate interrupt status length (bsc#1272522).
CVE-2026-63904: usb: usbtmc: check URB actual_length for interrupt-IN notifications (bsc#1272523).
CVE-2026-63913: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (bsc#1272890).
CVE-2026-63942: parport: Fix race between port and client registration (bsc#1273023).
CVE-2026-63956: USB: serial: cypress_m8: fix memory corruption with small endpoint (bsc#1272473).
CVE-2026-63957: USB: serial: safe_serial: fix memory corruption with small endpoint (bsc#1272472).
CVE-2026-63961: usb: typec: altmodes/displayport: validate count before reading Status Update VDO (bsc#1272480).
CVE-2026-63963: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (bsc#1272471).
CVE-2026-64009: xfrm: Check for underflow in xfrm_state_mtu (bsc#1273879).
CVE-2026-64014: Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (bsc#1273769).
CVE-2026-64097: drm/amd/display: Validate GPIO pin LUT table size before iterating (bsc#1273480).
CVE-2026-64191: i2c: stub: Reject I2C block transfers with invalid length (bsc#1272211).
CVE-2026-64279: i2c: core: fix adapter deregistration race (bsc#1273953).
CVE-2026-64299: tracing: Prevent out-of-bounds read in glob matching (bsc#1273976).
CVE-2026-64320: nvmet: fix discover log page when offsets are used (bsc#1273420).
CVE-2026-64342: USB: iowarrior: fix use-after-free on disconnect (bsc#1274011).
CVE-2026-64348: usb: free iso schedules on failed submit (bsc#1274026).
CVE-2026-64372: cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (bsc#1273889).
CVE-2026-64373: cpufreq: Fix hotplug-suspend race during reboot (bsc#1273776).
CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links) (bsc#1273868).
CVE-2026-64378: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (bsc#1273603).
CVE-2026-64388: smb/client: fix chown/chgrp with SMB3 POSIX Extensions (bsc#1274061).
CVE-2026-64448: smb: client: restrict implied bcc[0] exemption to responses without data area (bsc#1273982). -…

Record: SUSE-SU-2026:4687-1
Updated: 2026-11-02

OSVUSN-8875-1 No score

linux, linux-aws, linux-aws-5.15, linux-aws-fips, linux-azure, linux-azure-5.15, linux-azure-fde-5.15, linux-azure-fips, linux-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle, linux-realtime, linux-xilinx-zynqmp vulnerabilities

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)